Bricks, Mortar and Malware: The New Cyber Risks Facing Property Managers

The evolving threat landscape is challenging block managers to ensure operational continuity, tenant safety and financial health from a physical and digital risk management perspective.

According to a July 2025 Royal Institution of Chartered Surveyors (RICS) report, 27% of UK buildings experienced cyber-attacks in 2024, a 16% year-on-year rise¹.

Cybersecurity Awareness Month in October, presents an excellent opportunity to take a fresh look at the vulnerabilities and how to build cyber resilience.

What makes real estate a prime target of cyber criminals?

Property transactions involve high-value transfers between multiple parties, a condition that attackers are seeking to exploit. Remote processes and e-signatures improve efficiency but reduce in-person checks and increase companies' digital footprints.

Cyber risks touch nearly every part of real estate operations, creating multiple points of vulnerability. As the business becomes more digital and interconnected, here are some of the issues to think about:

The smart building threat

Modern properties have complex, interconnected digital ecosystems that use automation in access control, CCTV, HVAC, elevators and building management systems (BMS). While automation enhances efficiency, it also expands the attack surface. A successful attack can disrupt heating, lighting or access to the building, potentially leaving tenants in an unsafe or uncomfortable environment.

Risk of financial fraud

Financial transactions, such as collecting rent, managing service charges and paying vendors, are common between tenants, lessors or landlords, making the real estate industry a prime target of cybercriminals. One of the common cyber threats is a Business Email Compromise (BEC) scam, where criminals impersonate trusted contacts in a bid to redirect payments. With the advent of AI, these scams have become more sophisticated, tricking property managers into sending funds to fraudulent bank accounts.

Third-party cybersecurity gaps

Property management operates through a complex ecosystem of contractors, maintenance teams and facilities management (FM) providers. While they provide essential services, these vendors and contractors can be the weakest links in your cybersecurity chain. Shared credentials, unvetted remote access tools and a lack of robust cyber policies can create back doors for attackers to exploit.

Digital portals and tenant data exposure

Tenants expect seamless digital communication, from online rent portals to mobile apps for service requests. However, these platforms are increasingly targets for cybercriminals who use fake apps, spoofed alerts and phishing emails to gain access to tenant data. One successful attack can result in a data leak and/or network interruption, eroding tenant trust and exposing sensitive information.

How can real estate firms strengthen their defences against cyber threats?

Property managers should embed clear supplier cyber clauses in all contracts, conduct regular security assessments and impose strict access control limitations for every third-party provider, no matter how trusted they may be.

Here is a practical, site-level checklist to build your cyber resilience:

• Staff training: Implement regular training on basic cyber hygiene for all employees so they can identify phishing and social engineering attempts.
• Multi-factor authentication (MFA): Make multi-factor authentication mandatory for all administrative access, tenant portals and building management systems.
• Vendor protocols: Establish precise cybersecurity requirements in all contracts with suppliers and conduct periodic security assessments.
• Fraud payments: Implement dual verification for all changes to bank details, make mandatory confirmation calls to known contacts and impose a 48-hour waiting period for any such changes to stop most fraudulent schemes effectively.
• Patch management: Identify and replace outdated operating systems or unsupported firmware.
• Incident response playbook: Develop a tailored response plan for each building or portfolio that outlines clear steps to take during a breach.
• Board reporting: Integrate digital risk as a standing item in your regular governance and board updates.

Stay updated with the insurance and regulation changes

In the UK, tighter rules and insurance conditions are changing how organisations deal with cyber threats, with a July 2025 proposal to ban ransomware payments by public-sector-linked bodies demonstrating this shift². The message is simple: instead of paying up after an attack, organisations are expected to take stronger steps to prevent one happening in the first place.

In return for cover, underwriters increasingly demand proof of fundamental controls like MFA, a formal incident response plan and thorough third-party vetting, making it necessary for boards to ask questions about their organisation's cyber posture to ensure insurability and good governance.

Protect your properties from the next cyber threat

The average cyber-attack cost for a medium or large business in the UK was estimated at £10,830³. As innovative building systems become more connected, the risks grow.

Contact your Gallagher representative today to learn more about protecting your business from diverse cyber threats.