IBM 's ethical hacking team , known as X-Force, conducted a 2016 investigation into a national real estate company.
The IBM team attacked the internet firewall of one of the buildings supervised by the property management company and managed to gain access to the building's systems with relative ease.
“We could adjust the temperature, turn off the air conditioning, potentially shut down the servers,” said Chris Poulin, head of research at X-Force. “If a malicious hacker wanted to do that, they could do harm in a number of ways.”
This scenario could happen. New, state-of-the-art buildings are often targeted by hackers, while location-tracking devices like GPS have experienced many attacks and breaches.
Such an incident occurred in 2017, when a hacking group attacked a hotel in Austria, freezing the system that generated electronic keys for guests and demanding a ransom.
And just last year, a cyberattack leaked the information of 500 million guests of the Marriott Hotels chain, which ranked as the second largest data breach in history.
Some real estate companies aren't very good at protecting their data. The industry has been a frequent target of hacking in recent years, with about 11,300 attacks last year, totaling nearly $150 million, according to the FBI's Internet Crime Complaint Center.
Andrei Barysevich, director of Internet-Recorded Future, said that the majority of property owners are failing to protect their data.
“Real estate companies rarely know how to protect the data they hold,” he said. “I would guess that most owners have zero experience with securing their data, beyond maybe the implementation process.”
Many security breaches in the real estate industry typically occur when someone at a company opens a phishing email, he added. “I’ve seen firsthand how poorly trained the staff in this industry is,” Barysevich said.
