Cybersecurity for property management companies is a business risk, not just an IT topic. Property managers hold tenant applications with income details and identification, owner banking information for rent distributions, building access credentials, and connections to smart building systems. A 2026 report from Quorum Cyber found that cyber activity targeting the housing and construction sector increased by almost 61% year over year, with ransomware targeting the sector up 70% and data breaches up 38%. Most of the attacks start the same way they do in other sectors: a phishing email, a stolen credential, or a compromised vendor.

The good news for small and mid-sized property management firms in Canada and the United States is that a short list of controls addresses most of the risk. This guide covers what property managers should protect, which threats hit the sector hardest, and the controls that agencies on both sides of the border recommend.

Why are property management companies a target?

Property management firms are attractive targets because they combine sensitive personal data, regular money movement, and often limited security resources. A single firm may hold leases, tenant applications, Social Security or Social Insurance numbers, bank account details for owners and vendors, and access codes to buildings. Attackers know this.

Business email compromise (BEC) is common because property managers send and receive payment instructions regularly. A 2025 WTW analysis noted that cybercriminals use email addresses nearly identical to trusted sources to trick real estate businesses into revealing sensitive information or transferring funds. A fraudulent email asking to change vendor banking details, sent from a spoofed address, can redirect a single payment or an entire month of owner distributions.

Ransomware is also prevalent. The same WTW report observed that ransomware attacks can disable critical property management systems, causing business interruption where hackers encrypt the data needed to carry out day-to-day operations. Quorum Cyber's 2026 housing sector analysis found the US and UK were among the most frequently targeted countries for ransomware in this sector.

What data do property managers need to protect?

Property management firms hold several categories of sensitive information:

  • Tenant and applicant data: Names, contact information, income verification, credit reports, identification numbers, and references. Applicants who do not become tenants still submitted personal information.
  • Owner and investor information: Banking details for rent distributions, tax information, ownership structures, and contact details.
  • Vendor and contractor records: Payment information, insurance certificates, and access credentials.
  • Building access credentials: Key codes, fob assignments, smart lock credentials, and security camera access.
  • Financial records: Rent rolls, trust account details, expense reports, and year-end statements.

Canadian property managers that collect, use, or disclose personal information in the course of commercial activities may be subject to PIPEDA or to a substantially similar provincial privacy law. PIPEDA requires an organization to designate an individual accountable for privacy compliance and to retain personal information only as long as necessary for the identified purposes. British Columbia, Alberta, and Quebec have substantially similar provincial statutes that generally apply instead of PIPEDA to intra-provincial commercial activities.

What happened to property managers who got it wrong?

Regulatory enforcement shows the cost of getting this wrong. In August 2025, Massachusetts Attorney General Andrea Campbell announced a $795,000 settlement with Peabody Properties after five cybersecurity breaches between November 2019 and September 2021. The breaches exposed Social Security numbers, driver's license numbers, and bank account information for thousands of residents. According to the Attorney General's office, hackers gained access through phishing emails.

The settlement required Peabody to implement phishing protection software, multi-factor authentication, a vulnerability management program, an asset inventory, an intrusion detection and prevention system, and a security incident and event management platform, and to conduct an annual security assessment for three years. The case illustrates a pattern: phishing leads to credential theft, credential theft leads to data exposure, and the business faces regulatory penalties, notification costs, and reputational damage.

What controls do property management companies need?

CISA's guidance for small businesses and the Canadian Centre for Cyber Security's Baseline Cyber Security Controls both recommend a core set of measures that apply directly to property management. Five controls address most of the risk:

1. Multi-factor authentication everywhere

Enable MFA on every account that touches sensitive data: email, the property management platform, accounting software, and banking portals. CISA recommends requiring MFA using technical controls, not relying on users to opt in. Text-message codes are better than nothing, but app-based authenticators or hardware keys provide stronger protection.

For property management, MFA is especially important on tenant portals and owner portals, where unauthorized access can expose personal information or redirect payments.

2. Security awareness training and phishing simulations

An April 2026 Foundation for Community Association Research snap survey of 196 community association professionals across 37 U.S. states found that 38% ranked phishing scams among the top cybersecurity risks facing their community, the highest category in the survey. Staff who handle rent payments, vendor invoices, and owner distributions are frequent targets for BEC attacks.

Training should include realistic phishing simulations run at least monthly, immediate feedback when someone clicks a simulated phish, and specific scenarios for payment fraud. Any request to change banking details should trigger a phone call to a known number for verification. Our guide to security awareness training that works for small businesses covers what the research says about effective programs.

3. Tested, isolated backups

Ransomware attackers often target backups specifically. Quorum Cyber's 2026 report noted a 70% increase in ransomware targeting the housing sector, and a backup that is online and accessible from the compromised network is not a recovery option.

Ensure backups are stored offline or in immutable storage that cannot be encrypted by an attacker with network access. Test restores regularly. As we discuss in what cyber insurers check before quoting a policy, carriers now ask for documented restore tests before they will write coverage.

4. Vendor and building-system access management

Property managers rely on contractors, maintenance teams, and software vendors who need some access to systems or buildings. Each vendor relationship is a potential entry point if not managed.

Maintain a register of vendors who hold your data or have access to your systems. Review it annually and remove vendors no longer needed. For building systems (smart locks, cameras, HVAC, access control), place them on separate network segments from office computers, change default passwords, and require vendors to authenticate with named accounts. Our article on third-party vendor risk from an SMB perspective covers how to evaluate the vendors your business depends on.

5. A written incident response plan

CISA recommends that small business CEOs review and approve an incident response plan, participate in tabletop exercises, and invoke the plan even for suspected false alarms. The Canadian Centre for Cyber Security lists incident response planning as one of its baseline controls for small and medium organizations.

For property management, the plan should address who decides whether to take systems offline, who contacts affected tenants and owners, and how to continue operations if the property management platform is unavailable. A brief discussion of "what would we do if we came in Monday morning and all our systems were encrypted" surfaces gaps before a real incident. Our guide to incident response planning before something happens covers the key questions to think through.

Does the FTC Safeguards Rule apply to property managers?

The FTC Safeguards Rule applies to financial institutions that are significantly engaged in financial activities, or activities incidental to them. According to the National Association of Realtors, a real estate brokerage that engages only in traditional brokerage activities (listing, negotiating, or administering a closing) should not be subject to the Rule, because Federal Reserve Board regulations carve out real estate agents and brokers from the definition of "finder," and the FTC has stated that amending the definition of financial institution to include finder activities was not intended to lead to significant expansion of coverage. Property management is not the same as brokerage.

Property management companies that perform financial activities, such as mortgage brokering, settlement services, or certain lending activities, may be covered. Companies should consult legal counsel to determine whether the Safeguards Rule applies to their specific operations.

What should Canadian property managers know about PIPEDA?

PIPEDA may apply to property management companies that collect, use, or disclose personal information in the course of commercial activities. Key requirements include designating an individual accountable for privacy compliance, obtaining meaningful consent for collection and use of personal information, and limiting retention to what is necessary for identified purposes.

For property managers, this means having a clear policy on how long tenant applications, lease records, and owner information are retained, and disposing of data when it is no longer needed. In British Columbia, Alberta, and Quebec, substantially similar provincial privacy laws generally govern intra-provincial commercial activities instead of PIPEDA.

What questions should you ask your IT provider?

Property management firms that rely on an IT provider or managed service provider should ask concrete questions about security coverage:

  • Is MFA enforced on all accounts that access our property management platform and email, and can you show me an enrollment report?
  • When a security alert fires on a weekend, who sees it and how quickly can they respond?
  • Where are our backups stored, can an attacker with access to our network encrypt them, and when was the last successful restore test?
  • What happens to our data if we end the relationship with our property management software vendor?

Uncertain answers are themselves findings. A managed IT services provider with integrated cybersecurity can handle the technical controls while your team focuses on property operations. Cyber Unit provides 24/7 SOC monitoring, endpoint detection and response, email security, and security awareness training for small and mid-sized businesses across Canada and the United States.

Where to start

The five controls above (MFA, training, tested backups, vendor management, and an incident response plan) address the threats that hit property management hardest. Most do not require a large budget, but they do require someone to own them.

If you are unsure where your organization stands on security fundamentals, a free cybersecurity assessment covers 22 security areas in under 5 minutes and delivers prioritized recommendations. It is a useful starting point before investing in larger initiatives or evaluating providers.

This article is intended for general informational purposes only and does not constitute professional security, legal, or compliance advice. Regulatory requirements described are based on public sources as of the date of publication and may change. Organizations should consult qualified legal and cybersecurity professionals to determine their specific obligations and appropriate controls for their circumstances.