Real Estate Transactions Stalled as Baltimore Tax System Hobbled by Ransomware

The city government in Baltimore, Maryland, has been hobbled by a ransomware attack that could potentially delay numerous real estate transactions indefinitely thanks to the encryption of information on property taxes, property tax liens, and many other sensitive municipal government duties and data. The attack, which was initiated on May 7, 2019, shut down multiple municipal systems. The malware, now dubbed Robbinhood, came with a demand for $17,600, paid in bitcoin, per affected area of government operations. The hackers said they would release systems once the ransom was paid. They did not shut down the city’s 911 or 311 systems.

When the Baltimore city government elected not to pay the ransom, the hackers began posting tweets with images showing they are in possession of sensitive data from the city systems. However, security experts dealing with the crisis say the post could be unrelated to the initial ransomware attack since an employee with access to this information could be making the posts. On the other hand, the posts could be legitimate and intended to “make a statement,” as one security expert involved in the case put it. Eric Sifford, a security researcher with Armor’s Threat Resistance Unit (TRU), suggested the posts may “show that [the hackers] not only were able to encrypt major portions of the network of the city, but they have a lot of internal access as well.”

It is unlikely the public will discover if the information is legitimate or not since the City of Baltimore appears to have time to change posted usernames and passwords, for now at least. The hackers have released a threatening note reading, in part, “We’ve watched you for days, and we’ve worked on your systems to gain full access to your company and bypass all of your protections…All we know is MONEY! Hurry up!” The note concluded with the threat that in 10 days, the files will remain encrypted permanently.

What This Means for Real Estate Transactions

While the city government’s systems remain in lockdown, real estate transactions cannot proceed because it is impossible to verify whether properties have liens against them. These liens create a “cloud” on a title and must be cleared before sale or, in some cases, can be passed on to the new owner of the property. Tax sales in the Baltimore area have been postponed indefinitely, and title insurance companies have issued notices telling agents to put a stop to deals in Baltimore until the issue is resolved.

“It’s crippling the entire city for sure,” said Amy Caplan, operations manager at local Broadview Title. The city’s finance department reported it attempted to provide accountings of outstanding liens against properties scheduled for closings but was not able to predict how long it might take to access that data. About 1,500 pending sales are presently stalled, the city is unable to accept property tax payments although agencies are trying to develop workarounds, and utility payments have also been suspended in some cases.

The workarounds could involve a return to paper systems while the online systems are restored, but the long-term effects on the real estate market could be staggering since many homebuyers will walk away once the their contracts to buy expire and many tax lien investors will simply find other areas of the country in which to operate rather than take the risk that they will not be able to conclude their tax lien deals either by taking ownership of the property if the lien remains unpaid or by receiving payment and interest if the homeowner redeems the property.

Tax Sales Will Continue in a Controversial Decision

For the time being, Baltimore officials said they would continue with scheduled tax sales but would not place properties of homeowners who made their payments between April 30, 2019 (the property tax deadline) and May 7, 2019 (the date of the attack) on the block. However, since investors who acquire properties at this particular tax auction could be unable to foreclose on the properties if the debts are not paid, it is yet to be seen whether the sale will bring in anything close to the usual $20 million in income usually generated. It seems likely many of the liens will be contested on properties that do go into the sale since the tax sale office could only accept payments from people who had paper correspondence indicating the amount they owed and could not accept payments via credit or debit card.

Unless Baltimore opts to pay the ransom, something that the mayor has refused to do so far, the city could have to hack into its own systems or build new ones in order to resume “business as usual.” This could take months. Clifford Rossi, a business professor at the University of Maryland, said hackers know local governments tend to be unprepared to handle this kind of encryption-based attack. “Most governments don’t run themselves as a business … [which] would have a solid business continuity plan in place,” he explained. Rossi added, “They’d have backup systems, dedicated data warehousing for sensitive information.”