INDUSTRY FACT FILE · REAL ESTATE, CONSTRUCTION & FACILITIES

Threat Landscape: Top Cyber Threats Facing Real Estate, Construction and Facilities

The 18 most relevant cyber threats, attacks and industry challenges for developers, contractors, property groups, co-working operators and facility managers, and the impact each one has on buildings, deals, tenants and buyers.

Property, construction and facilities companies attract ransomware groups because launches, billing cycles and tenant services cannot pause without visible loss; fraudsters because the sector moves large payments to many contractors, brokers and buyers; and opportunists because buildings expose cameras, doors and controllers to the internet with default settings. The attack surface is unusually public: a compromised BMS or lift controller fails in front of tenants, an exposed camera streams a lobby to the world, and a stolen buyer database fuels fraud against the developer's own customers.

Landmark incidents show the pattern. The 2021 Verkada breach reached about 150,000 live camera feeds through one support account; Target's 2013 breach of 40 million cards began with its HVAC contractor; a 2016 denial-of-service attack left apartment blocks in Lappeenranta without heating; Bouygues Construction (January 2020) and ISS World (February 2020) shut down global IT after ransomware and malware attacks; First American Financial exposed about 885 million title and mortgage records in 2019 through a website flaw. In India, Ansal Housing disclosed repeated ransomware attacks in 2021, and the FBI's IC3 reported US$2.77 billion in business email compromise losses in 2024—a crime that targets property transactions and contractor payments worldwide.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by real estate and facilities segment (Codec Networks assessment).

4.1 Building systems reachable from outside

BMS, lift, fire and energy systems are installed by integrators, left with default credentials and maintained through standing remote access. The Lappeenranta heating outage and the Verkada breach show how a single exposed system or account affects every occupant at once.

• Questions to test: Which building systems are reachable from the internet or tenant networks? Which vendors hold remote access and is it brokered and recorded? Are building, security, corporate and tenant networks separated?
• Relevant services: building system assessment, segmentation design, remote access brokering, OT monitoring.

4.2 Cameras, doors and privacy

CCTV and access control are safety systems and personal-data systems at once. Cloud platforms concentrate risk across sites, and since April 2025 cameras sold in India must meet MeitY's essential requirements.

• Questions to test: Who can view live and recorded video? Are platform accounts named, with MFA and rotation? How long is footage retained and under what notice? Do our cameras and procurement meet MeitY requirements?
• Relevant services: CCTV and access control testing, identity controls, surveillance privacy review, MeitY ER evidence.

4.3 Payment diversion on contractor and buyer payments

Construction and property move large payments on predictable cycles to hundreds of counterparties. Attackers watch invoice threads and send convincing bank-detail changes; the FBI counted US$2.77 billion of BEC losses in 2024.

• Questions to test: Are bank-detail changes verified by call-back and dual approval? Are vendor master-data changes monitored? Are finance, site and sales teams trained with simulations? Do we monitor look-alike domains?
• Relevant services: payment control review, master-data monitoring, BEC simulation, email security.

4.4 Buyer, tenant and visitor data

Developers hold KYC, PAN and bank details for every buyer; co-working operators and FM companies hold member and visitor records and video. Stolen data is used to defraud the company's own customers, and DPDP breach intimation arrives in May 2027.

• Questions to test: Where is buyer, tenant and visitor data stored and who can export it? Are portals and apps tested? Do brokers and channel partners handle data under controls? Is there a breach playbook?
• Relevant services: DPDP programme, data classification and DLP, portal and app testing, breach playbooks.

4.5 Detection, reporting and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident; listed companies disclose quarterly. Building systems and vendor sessions are usually unmonitored, so intrusions are found late—often by tenants.

• Questions to test: Are IT, building systems and security platforms monitored 24x7? Do we see vendor sessions and configuration changes? Is there a playbook covering tenant safety, containment, CERT-In reporting and disclosure?
• Relevant services: building SOC, playbooks, incident records, joint drills with FM and security teams.

• CERT-In: incidents reported within six hours of noticing them; logs available for investigation.
• SEBI LODR and REIT rules: listed developers, contractors and REIT managers disclose cyber incidents in the quarterly corporate governance report.
• RERA: incidents that disrupt collections, escrow or buyer communications can affect filings and timelines.
• DPDP: incidents involving buyer, tenant, visitor or employee data, including footage, trigger breach intimation once provisions commence in May 2027.
• Occupiers and lenders: lease and loan agreements increasingly require incident notification and evidence of controls.
• Insurers: policies require prompt notification and evidence that warranted controls were in place.

• Which building systems can be reached from the internet, and who has remote access to them?
• Could a fake bank-detail change divert a contractor or buyer payment without anyone noticing?
• Who can view our cameras and change our door schedules, and would we know?
• If ERP and CRM went dark on launch weekend, could we book, receipt and communicate?
• Where is buyer, tenant and visitor data, and are we ready for DPDP breach intimation?
• Could we detect, contain and report an incident within six hours while keeping tenants safe?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events, regulator statements and company disclosures.