🔴

PetScreening's Cloud Credential Leak May Have Exposed Your ESA Records

In March 2026, a cybersecurity firm found live AWS credentials for PetScreening posted on a hacker forum — giving attackers full access to tenant ESA records, disability data, and healthcare provider information.

In late March 2026, a cybersecurity intelligence firm found something alarming: active cloud credentials for PetScreening — the property tech company that processes ESA screenings for millions of U.S. renters — posted on a monitored hacker forum.

The credentials weren't expired. They weren't rotated. According to the report, they were marked "valid: true" at the time of discovery.

If you've submitted an emotional support animal accommodation request through any apartment complex using PetScreening, your data may have been at risk.

What Was Exposed

PetScreening's breach involved the leak of AWS IAM credentials — essentially master keys to the company's cloud environment. The reported exposure included:

  • Active AWS Access Key ID and Secret Access Key — still functional at time of discovery
  • Full-control S3 bucket access — meaning an attacker could read, download, delete, or modify files in PetScreening's cloud storage
  • CI/CD pipeline compromise — the credentials came from a compromised GitHub runner, which could allow injection of malicious code into PetScreening's software updates

The source was BrinzTech, a cybersecurity firm that monitors dark web and hacker forums for leaked credentials targeting real estate and PropTech companies. Their alert was published March 26, 2026.

Why This Matters for ESA Tenants Specifically

PetScreening isn't a generic software company. The data they store is particularly sensitive for ESA tenants:

What PetScreening collects when you submit an ESA request:

  • Your disability status (they require confirmation)
  • Your healthcare provider's name, license number, and contact information
  • Your ESA letter (a medical document)
  • Your home address tied to all of the above
  • Pet behavioral history and microchip numbers

This is the exact category of data that CCPA and Fair Housing Act protections are designed to secure. A breach exposing disability status, ESA documentation, and healthcare provider data for millions of tenants is a serious regulatory event — and potentially a federal civil rights matter.

PetScreening Already Sells Your Data

Here's what makes this worse: PetScreening was already selling tenant data before this breach.

Their own privacy policy (updated July 2025) states:

"If you consent, we may Sell or Share your Personal Information."

The data that was potentially exposed to hackers is the same data PetScreening was already sharing with third-party marketing companies and service providers. Tenants with ESAs have reported receiving spam email floods after submitting ESA documentation through PetScreening.

A credential leak of this magnitude doesn't just risk a one-time breach. It means an attacker with full S3 access could have copied the same data PetScreening was already monetizing — before anyone knew.

The Regulatory Exposure

CCPA (California): Health and disability data breaches require notification and create private right of action. California tenants may be entitled to damages of $100–$750 per incident, per consumer.

Fair Housing Act: ESA accommodation data is protected under fair housing law. A company handling this data has an obligation to secure it. HUD takes data security in housing-related transactions seriously.

HUD Enforcement: HUD has previously investigated property tech companies for fair housing violations. A systemic data breach affecting protected accommodation requests could trigger an investigation.

What You Should Do

If you've submitted ESA documentation through PetScreening at any point:

1. Monitor for phishing attempts. Your healthcare provider's information and your home address are now potentially in unknown hands. Watch for targeted scam calls or emails.

2. Consider filing a HUD complaint. If you believe PetScreening's data handling has harmed you — whether through the breach, data sales, or illegal fees — you can file online at hud.gov/program_offices/fair_housing_equal_opp/online-complaint.

3. Notify your healthcare provider. Their license number and contact information was part of your ESA documentation. They should know their information may have been exposed.

4. Document everything. Any fees you paid for PetScreening processing, your original ESA letter, and your accommodation request date are evidence in potential legal actions.

The Bigger Picture

PetScreening has now racked up a list of issues that should concern every landlord that uses them and every tenant forced to go through them:

  • ❌ Their own privacy policy admits data sale to third parties
  • ❌ March 2026: Fair Housing Council of Oregon flagged them as a landlord liability risk
  • ❌ AWS credential leak potentially exposed tenant disability records to bad actors
  • ❌ Manufactured "12-month renewal" rule for ESA letters has no federal legal basis
  • ❌ Charging tenants to use their platform is a Fair Housing Act violation

This isn't a company with one bad quarter. This is a pattern.

Tenant Pet Rights publishes free legal information for renters with assistance animals. We are not a law firm and this is not legal advice. Source for credential leak: BrinzTech breach alert, March 26, 2026.