AppFolio, Inc., a leading provider of cloud-based business software for the real estate industry, experienced a data breach stemming from a security incident involving one of its vendors, Salesloft, a sales enablement software provider. The cybersecurity incident reportedly involved hundreds of companies working with Salesloft.
AppFolio was first alerted of the data breach on Aug. 22, 2025. The incident was traced back to unauthorized access to AppFolio’s customer relationship management (CRM) system through a vulnerability in Salesloft. An unauthorized actor was able to retrieve data from AppFolio’s hosted CRM system, specifically targeting a location that contained personal information between Aug. 8 and Aug. 18, 2025
An investigation took place and on Sept. 18, 2025, determined that the data breach compromised names and Social Security numbers. The AppFolio incident affected a total of 72,444 individuals in the United States.
The cyberattack was disclosed to multiple state authorities beginning on Oct. 6, 2025, including the Maine, Massachusetts, Oregon, Texas, Montana and New Hampshire Attorney Generals' offices. Affected individuals includes 5,056 Texas residents, 148 in Maine, 932 Massachusetts residents, 337 in Montana and 231 in New Hampshire.
In response to the breach, AppFolio took action by disabling all Salesloft integrations to prevent further unauthorized access. The company began mailing notification letters to impacted individuals on Oct. 6, 2025. AppFolio is also offering up to 24 free months of TransUnion Cyberscout credit monitoring and identity theft protection services to affected individuals.
If you receive a data breach notice from AppFolio or Salesloft about this breach, you may want to:
For more information about the real estate technology company, visit the official AppFolio website.
A breach notice means your personal details could be circulating far beyond the organization involved. One practical step is continuous monitoring: services such as Identity Defender (included with an ExpressVPN subscription) can automatically check dark-web markets, flag new credit-file activity, and request removal of your information from data-broker sites.
This kind of “early-warning system” can’t undo a breach, but it can help you spot misuse quickly and limit further exposure. ExpressVPN is offering 61% off, risk-free for 30 days, with ID Theft Insurance included and no extra cost for those who sign up for one or two years.