Cybersecurity in Real Estate: An Overlooked Risk
Sensitive data, independent agents, and little training: a recipe for risk
Somewhere along the line in the past few years, I got my real estate license. My brief exposure to the industry has shown me that pound for pound, no sector may be more exposed to cybersecurity threats than real estate.
At my brokerage, an incident occurred where a threat actor obtained information off Zillow about an unsold land listing. They reached out to our brokerage requesting to relist with us. They had done their research. Using the same public records available to us, they identified the legitimate owner of the land. Then, they impersonated them, creating a Gmail address that closely resembled the owner’s name, and initiated contact.
They used the same social engineering techniques common in corporate attacks. They created a sense of urgency, insisting the property be listed immediately. Not wanting to lose what seemed like a legitimate client, our broker obliged and listed the property. A few days later, the actual owner of the land contacted us, and the listing was quickly removed without financial loss. Still, the experience gave our brokerage pause and raised serious questions about how to handle similar situations in the future.
For me, it was a moment of reflection, connecting my experience in corporate cybersecurity with the vulnerabilities in real estate.
Why Real Estate Is a Prime Target for Cyber Threats
1. Real Estate Agents Handle Extremely Sensitive Data
Agents collect names, phone numbers, addresses, pre-approval letters, and even copies of escrow checks containing account details. For a threat actor, a real estate transaction is a goldmine of personal and financial information, all bundled together.
2. Agents Operate as Independent Contractors
Unlike corporate employees, most agents use their own laptops, personal email accounts, and whatever level of security knowledge they happen to have. Many do not use enterprise-grade tools, and in some cases, they may not even have up-to-date antivirus software. This means that when you email a scanned escrow check, there is no guarantee it is being stored or transmitted securely.
3. Rogue Attacks and Long-Tail Consequences
Imagine becoming a victim of identity theft months or even years after closing a home. A new credit card appears on your credit report, or a fraudulent loan surfaces. Would you ever trace it back to a real estate agent’s compromised inbox? Probably not. This lack of visibility makes real estate an especially appealing vector for cybercriminals.
4. Lack of Cybersecurity Training
In the corporate world, we sit through monotonous but necessary cybersecurity training sessions. Real estate agents, on the other hand, are required to complete Continuing Legal Education (CLE) to maintain their license. Yet cybersecurity awareness is not part of the curriculum. This gap leaves agents unprepared to identify phishing attempts, social engineering tactics, or malware threats.
What Can Be Done?
We could shoot for the stars and require brokerages, many of which operate on the independent contractor model, to begin treating agents like full-time employees. This would include providing secure devices, standardized email platforms, and mandatory training. But that is unlikely to happen overnight.
A more practical step would be to integrate cybersecurity training into the real estate licensing process and CLE requirements. Even basic awareness could help prevent many of the attacks currently slipping through unnoticed.
In cybersecurity, you eventually learn to stop blaming end users. Incidents are inevitable. What matters is how organizations prepare for and respond to them. Real estate has not reached that stage of maturity yet. The industry still treats cyber incidents as anomalies instead of inevitabilities. Until that mindset shifts, it will remain one of the most exposed sectors.