When a property management company suffers a data breach, the response has three moves:

1. Secure your operations, so no more data is lost.

2. Fix the weakness that let the breach happen.

3. Notify the people and organizations you’re required to, or ought to, tell.

That structure follows the U.S. Federal Trade Commission’s guide for businesses, and it applies whether the breach is a hacked email account, ransomware or a lost laptop. In practice the moves overlap. Start the legal assessment of who must be notified straight away, alongside containment, so no notification deadline is missed.

For example: on a Wednesday morning, a plumbing vendor calls accounts payable. Why hasn’t last month’s payment arrived?

AP checks. The vendor’s bank details were changed two weeks ago, following an email that looked like it came from the vendor. Two payments went to the new account.

Then IT finds that a leasing coordinator’s email account has been signing in from another country for a month. Her mailbox holds rental applications, screening reports and copies of residents’ IDs.

What began as one missing payment now looks like a data breach. The team still has to confirm whether the two events are connected, and what was actually accessed. The next few days decide how much more it costs.

Why are property management companies exposed?

Because they hold a lot of sensitive data about a lot of people. A single system can store tenant personal information, including identity documents, bank account details for rent collection, lease agreements and income verification, along with vendor payment information.

Property companies also share data with many vendors, such as screening providers, payment processors and maintenance platforms. A breach at any of them can expose your residents’ data even when your own security is sound.

Secure, fix, notify

This is the framework: three moves that often run side by side.

1. Secure your operations

The FTC’s first step is to move quickly to secure your systems and stop additional data loss. In practice, that means:

• Assemble the response team. Bring in your IT lead, legal counsel and, for anything beyond a minor incident, independent forensic investigators. The FTC suggests exactly this mix.

• Contain the breach. Take affected devices offline, but don’t turn them off until the forensic experts advise, because shutting them down can destroy evidence. Reset compromised passwords, and close any access the attacker used.

• Preserve the evidence. Don’t wipe or rebuild systems until the forensic team has captured what it needs. Containing the breach and preserving evidence can pull in different directions, so let the experts sequence them.

• Stop the money. If payment details were changed, contact your bank immediately, freeze further changes to vendor and owner bank details, and confirm every recent change through a phone number you already had on file.

2. Fix the weakness

Once the cause is found, close it, and check that it’s really closed:

• Find how it happened. Phishing, weak passwords, an unpatched system, a vendor’s access, or a lost device.

• Fix the cause, not just the symptom. Add multi-factor authentication, tighten access, or remove a vendor’s unnecessary access.

• Check vendors. If a service provider was involved, review what data and access they hold.

• Verify the fix. Have your forensic experts confirm it worked.

3. Notify the right people

Notification has legal deadlines and content rules, so work through it with counsel, starting early:

• Determine your legal obligations. All 50 states have laws requiring businesses to notify individuals of breaches of personal information. They differ in what data they cover and what counts as a reportable breach, so not every incident triggers notice. Timelines, content and whether a state regulator must be told also vary by state, and usually depend on where the affected people live, not just where your company is.

• Coordinate with law enforcement. The FTC recommends consulting law enforcement on the timing of notifications, so they don’t interfere with an investigation. Don’t let that coordination push you past a legal deadline.

• Notify affected businesses. If you hold data on behalf of others, tell them. For third-party managers, that includes property owners, under your management agreements.

• Notify individuals. Tell residents, applicants or vendors clearly what happened, what information was involved, what you’re doing about it, and what they can do to protect themselves.

Add one property-specific warning to resident and vendor notices: tell them how you will, and won’t, ask for changes to payment details. Attackers who have stolen data often follow up with fake payment instructions.

Who needs to hear from you?

Who owns each step?

What should leadership watch?

Within a few weeks of the breach, hold a review:

• How the breach was found, and how long it went unnoticed.

• Which step took longest: containing it, finding the cause, or working out who to notify.

• What the response plan didn’t cover.

And one control question: if a staff email account were compromised tonight, does everyone know who leads the response, who calls the bank, and who calls the lawyer? RIOO’s guide to property management data security covers the preparation that makes that answer yes.

Where RIOO fits

RIOO is property management software built directly on NetSuite.

• Access by role. RIOO uses role-based access controls to limit what each employee can do. That reduces how much data a single compromised account can reach.

• Logs and alerts. RIOO’s guide to NetSuite security and data privacy covers configuring breach detection and alert workflows. While NetSuite isn’t a dedicated security monitoring platform, these alerts can give early warning, and system logs help investigators reconstruct what happened.

Note: This blog is general guidance, not legal or cybersecurity advice. Breach notification rules vary by state and by the type of data involved. Involve legal counsel and qualified forensic experts as soon as a breach is suspected. Last reviewed October 2026.

Frequently asked questions

Q1. What should a property management company do first after a data breach?
Secure its operations: assemble a response team with legal counsel and forensic experts, contain the breach, preserve evidence, and contact the bank if payment details were involved. Start the legal assessment of notification at the same time.

Q2. Do property managers have to notify tenants of a data breach?
Often, yes. All 50 states have breach notification laws covering personal information, but they differ in what data and incidents they cover, and in timing and content. Check them with counsel.

Q3. Who else needs to be notified after a breach?
Depending on the breach and the law: your insurer, law enforcement, state regulators where required, property owners whose data or residents’ data was involved, and your bank and payment processors.

Q4. Should law enforcement be contacted?
Yes. The FTC recommends contacting law enforcement, and coordinating the timing of individual notifications with them so the investigation isn’t compromised, without missing any legal deadline.

Q5. What should a breach notice to residents include?
What happened, what information was involved, what the company is doing about it, what residents can do to protect themselves, and who to contact with questions.

Q6. What is business email compromise in property management?
An attack where criminals use a hacked or spoofed email account to redirect payments, for example by asking AP to change a vendor’s bank details, or telling residents to pay rent into a new account.

Q7. How can property managers prepare for a data breach?
By knowing where sensitive data is held, including with vendors, limiting access by role, contracting for breach notification with vendors, and having a written response plan with named roles. RIOO’s guide to property management data security covers this preparation in detail.