Financial fraud, data breaches & ransomware
Residential property managers handle private data, move money daily and rely on technology, making them prime targets for cybercrime. Understanding common cyber threats and cybersecurity controls can help residential property managers protect their businesses, their properties and the residents they serve.
Having dedicated nearly 15 years to advising property management firms on insurance and risk management, Kyla Troll, Senior Client Executive, Real Estate, has the insights you need. Read on to learn about the three most common cyber attacks that residential property managers face and the cybersecurity controls that underwriters expect.
3 common cyber attacks against residential property managers
Canadian residential property managers have exactly what cybercriminals want:
- contracts with several multi-unit properties
- numerous vendor relationships
- banking details and other private information for each unit owner and tenant
- daily cash flow
- technology reliance
Here’s how opportunistic cybercriminals utilize what residential property managers have to launch sophisticated attacks.
Funds Transfer Fraud
Cybercriminals don’t always steal directly from their victims’ accounts.
In the case of residential property managers, cybercriminals will often trick their victims into sending money right into their coffers.
For example, a cybercriminal impersonates your garbage removal vendor and sends you new wire transfer information.
As it’s payment you expect and a “vendor” you trust, you transfer the funds to the new (fraudulent) account for all your applicable properties.
You only realize the costly mistake when your legitimate vendor follows up 30 or 60 days later to say you haven’t paid.
Data Breaches
All the owner and tenant information that residential property managers keep on file is low hanging fruit for cybercriminals.
Names, contact information, banking details — once stolen, this information gets misused.
- Banking details can be used to steal money.
- Personal details like name, phone number and licence can be used to commit identity theft (i.e., apply for loans in the victim’s name).
- Contact information can be used in targeted phishing attacks and other scams.
Even though this type of cyber attack doesn’t target your finances directly, residential property managers still take a hit following a cyber breach.
Footing the bill for credit monitoring for those impacted, as well as paying legal fines related to provincial and national privacy acts are just part of the financial fallout. Reputational damage and lost trust can cause ripple effects in a competitive industry.
Ransomware
Portals for multi-unit residential properties provide a centralized hub for property managers and strata corporations/condo boards to share and store:
- Correspondence
- Financial records
- Bylaws and rules
- Meeting minutes
- Summary of insurance coverage
This presents an opportunity for cybercriminals to lock your systems and demand payment before they’ll restore your access.
By infiltrating systems, cybercriminals also commonly:
- Double extort their victims by threatening to leak sensitive data if payment isn’t received.
- Sell system access to other criminals, who can then launch their own attacks.
Being locked out of your systems won’t just bring your operations to a halt and cause you reputational harm; the ripple effects can extend to unit owners.
For example, an owner looking to sell their unit could potentially have half-a-million dollars on the line if they’re unable to access the portal and the property managers systems are locked, so the necessary forms and legal documents needed to close a sale are unavailable.
Why residential property managers need cyber insurance
“As residential property managers oversee cash flow, unit owner private information, vendor relationships and much more for each property, having cyber insurance is absolutely necessary.”
Kyla Troll, Senior Client Executive, Real Estate
Cyber insurance provides more than a cheque to recoup stolen funds. The strongest value of a comprehensive cyber insurance policy is that it connects you to the people and processes needed to minimize damage and jump back after a cyber attack.
Cyber insurance helps residential property managers:
- Launch a fast, coordinated response. A cyber insurance policy serves as an important component of your cyber incident response plan. Some policies include 24/7 access to an expert incident response team that helps to contain and investigate the cyber attack, as well as identify ways to avoid future attacks.
- Restore operations. A cyber insurance policy can help you restore data and recover systems, which can minimize operational downtime. It can also offset lost income during business interruption while systems are down.
- Protect their properties and unit owners. A cyber insurance policy can help residential property managers protect unit owners and tenants. This includes support with notifying residents, offering credit monitoring and fulfilling privacy act obligations.
6 cybersecurity controls underwriters want from residential property managers
We are seeing more detailed underwriting for residential property managers when it comes to cyber insurance.
Company size and claims history are just part of the equation for underwriters when it comes to evaluating risk. They also want to see evidence that residential property managers have specific controls in place to minimize their cyber risk. This includes:
Multi-factor authentication
Passwords are easy to steal. Accounts with multi-factor authentication add a second layer of protection, making it more difficult for cybercriminals to hack into.
Procedures around changes to wire transfers
Fund transfer fraud can be easily prevented with one simple process: reaching out directly to your vendor to verify the change to banking information.
(Note: Contact the vendor using the information you have on file, not by replying to the email in question.)
Strong security measures
Firewalls, antivirus, secure Wi-Fi connections and data encryption are the digital equivalent of locks and alarms on buildings. These security measures help to safeguard your systems and data.
Multiple backups
Backing up your files is a tried and trued risk management strategy that dates back long before the digital era. Regular backups mean you’ll have access to your data in the event of a cyber attack (i.e., ransomware), which can help minimize operational downtime.
In addition to backing up your digital files (with at least one backup stored offsite), also keep paper copies of key documents — contact lists, insurance policy, etc. It’s low tech, but will be instrumental in accessing the information you need most when your systems are compromised.
Employee training
Your employees are the weakest link when it comes to cybersecurity. Being inundated with emails daily makes it easy to click on a fraudulent email, giving cybercriminals access to your systems and information. Regular, bite-sized and reputable training can teach your team how to spot suspicious emails, verify links and not click on unknown attachments.
Cyber incident response plan
When it comes to cyber attacks, it’s a matter of when, not if. Residential property managers need to proactively prepare for the inevitable. Having a cyber incident response plan can help you respond swiftly, minimizing damage and operational downtime. At a minimum, your cyber incident response plan should include:
- Who to call in the event of a cyber attack (i.e., IT, lawyer, insurer)
- How to shut down compromised accounts or systems
- Pre-drafted resident breach notification templates
- Contact list stored offline in case systems are down and not accessible.
Cybersecurity protects what matters in property management
Residential property managers hold the keys to both money and data, and their operations rely on technology — three factors that attract cybercrime.
Understanding why attacks happen and incorporating proven cybersecurity controls into your operations can protect your business, your portfolio and the residents you have an obligation to protect.
The bottom line: cybersecurity is just as important as physical security.
FAQs: Cyber insurance for residential property managers
Acera Insurance’s Kyla Troll answers three questions about cyber insurance for residential property managers.
One of the most effective ways to determine your cyber insurance limit is to work with an Acera Insurance advisor who specializes in the real estate industry. We’ll benchmark by examining the details about your business (i.e., number of employees, number of properties) to determine your risk level and advise on an adequate cyber insurance limit.
Yes, choosing the right cyber insurer matters.
It is most beneficial for residential property managers to choose an insurer that does more than support with cost recovery. You want to choose an insurer that provides access to a response team to help with investigating and closing down the threat — this is mission critical for the longevity of your business.
Yes. Cybercrime is prevalent, making a cyber attack a matter of when, not if. In today’s digital era, cyber insurance is just as critical for residential property managers as coverage for water damage and negligence lawsuits (errors and omissions insurance).
Cybercriminals also see big opportunities in small and medium-sized businesses, like residential property managers. Small and mid-sized organizations tend to have less robust cybersecurity in place, compared to large corporations. This makes them easier targets for cybercriminals, who can quickly accumulate millions in stolen dollars by attacking several smaller enterprises.
Share this article:
Kyla Troll is a Senior Client Executive, Real Estate. She brings nearly 15 years of real estate risk management and insurance experience and proudly works with leading property managers and developers across British Columbia. You can connect with Kyla at 604.484.4956 and kyla.troll@acera.ca.
Get weekly tips to protect your business!
Subscribe to our LinkedIn Newsletter. Our advisors’ insights will help you Be Risk Ready.
Related reading:
- Dispelling five common reasons why businesses don’t buy cyber insurance
- What real estate owners need to know about liability insurance
Information and services provided by Acera Insurance, Acera Benefits and any other tradename and/or subsidiary or affiliate of Acera Insurance Services Ltd. (“Acera”), should not be considered legal, tax, or financial advice. While we strive to provide accurate and up-to-date information, we recommend consulting a qualified financial planner, lawyer, accountant, tax advisor or other professional for advice specific to your situation. Tax, employment, pension, disability and investment laws and regulations vary by jurisdiction and are subject to change. Acera is not responsible for any decisions made based on the information provided.
Get a quote.
Simply fill out a few details in our online form and one of our expert advisors will get your quote started.