DCAD Launches ‘Bare Bones’ Site For Basic Search Tools With New Service Provider, But is Consumer Info Safe?

Over at DCAD, the go-to website numerous times daily for nearly everyone in the working world of real estate, all they want for Christmas is patience.

Patience since the site has been down since the 8th of November. Patience that all appraisal work is being done by hand on paper. And patience with the new bare-bones site launched last week with the help of tech vendor BIS Consultants.

What are agents using to research properties?

Shortly after the hack, DCAD posted a message on its Facebook page about an alternative way to search: using the State Comptroller’s Property Tax Transparency website to see ownership and values: https://www.texas.gov/living-in-texas/property-tax-transparency/  then search for “Dallas County” where it says “Find your county’s website” to see property information. 

Agents have also searched on the MetroTex Dashboard via Realist Tax, but of course, all those numbers are only current as of 11/8/22, when the hack occurred.

Travis County Appraisal District Hacked, Too

DCAD is not the only public site hacked. In early December, the Travis County Appraisal District was hit with a Royal ransomware attack that shut down its phone lines and an online chat system. According to the Austin American Statesman, it was not clear whether a specific ransom demand was made because the agency refused to communicate with the hacker. Travis County did get its site back up and running within a week.

DCAD Setting Up Bare Bones Site

The Dallas Morning News reported that BIS Consultants, of Farmers Branch, an excellent company, according to our sources, has been enlisted for assistance. DCAD launched a new site on Thursday evening, a bare-bones structure for property owners some of whom are still working on appraisals. Insiders have told CandysDirt.com that a ransomware attack took over and locked the system, demanding a ransom from DCAD in order to regain access to the vast property data.

The new home website includes contact information for the agency, a list of local tax offices and a new property search function. The basic tools should provide property owners the ability search for ownership and values Jordan said, although there’s not much else available at the moment.

“We still are not fully operational,” Jordan said. “We still cannot process exemptions or deeds or anything, but we’re still working on that.”

“It’s bare bones right now,” Jordan said.

The agency charged with determining the values of Dallas County real estate says it plans to expand the website’s features and capabilities in the coming weeks, almost as if it is building a shadow site. A disclaimer on the site: “Dallas Central Appraisal District has a new service provider for the website. Please be patient as we add more content in the upcoming days and weeks.”

Because Dallas County manages DCAD, we have been working to confirm they have no insurance to pay off the ransomware attack. Most municipal agencies are self-insured.

CandysDirt.com spoke with Patrick Costello, co-founder and principal of evolvemga.com, a cybersecurity insurance firm that insures companies against this very sort of hacking. Costello says that ransomware is incredibly prevalent right now — both ransomware and WTF (wire transfer fraud).

How does a ransomware attack happen?

A hacker sends an email to someone in the company. If you click on the link, the ransomware opens up, infiltrates your system, and takes over like a virus. It can lock your system, which means you cannot work. Hence, business interruption is a massive part of evolving policies.

“Most likely someone clicked on a link and it invaded the DCAD system,” Costello said. “Do not click on unknown emails ever,” he warns, “and be especially careful transferring money.”

Some are calling for more transparency, information, and a higher level of security for DCAD, which is charged with calculating property tax bills. Travis County Chief Appraiser Marya Crigler explained that security protocols protected private taxpayer information from being accessed and allowed the agency to continue most of its operations. Property tax bills and payments with the Travis County tax office were unaffected, she said. But in Dallas, at least one tax consultant reports receiving a suspicious email after the hack that could have been related.

“The initial assurance that everything was public was concerning because the hackers had control over emails, which can often contain personal information,” says Glenn Goodrich, founder and CEO of propertytax.io. “I don’t know if that email came from the hack or not… which is part of the problem. DCAD should have given more details about what the phishing looked like. Was it a file similar to one in my email? I have no idea because they have provided zero details. It would have been more responsible for DCAD to say ‘be extra diligent since your email address may have been compromised if you have emailed us.’ We trust that government entities are safe with our private data — but the truth is, they may not be.”