ANYWHERE REAL ESTATE INC.

Anywhere Real Estate Inc. disclosed a cybersecurity incident discovered on November 24, 2025, involving its Oracle E-Business Suite. An unauthorized third party exploited a zero-day vulnerability to access the environment and exfiltrate personal information, including names, SSNs, and dates of birth, of current and former employees and franchisees. The company engaged third-party experts, remediated the vulnerability, and offered 24 months of credit monitoring.

Anywhere Real Estate Inc. notified the New Hampshire Attorney General of a cybersecurity incident involving its Oracle E-Business Suite. An unauthorized third party exploited a zero-day vulnerability (CVE-2025-61882) on August 13, 2025, to access the system and exfiltrate employee data, including SSNs and names. The breach was discovered on November 24, 2025, affecting 151 New Hampshire residents. Notices were sent on January 30, 2026, offering 24 months of credit monitoring.

Affected (this filing): 151