Cyber Insurance for REITs: Tenant Data, Building Systems and Wire Fraud

A REIT cyber insurance policy may pay for costs and liabilities that follow a breach of tenant or resident data, a ransomware attack, cyber extortion, lost data, a network outage, incident response, privacy claims, regulatory proceedings and some kinds of cyber-enabled fraud. Coverage is not standardized: cyber policies are highly customized, and the policy language controls, according to the NAIC (opens in a new tab). A fraudulent wire is its own question. Computer fraud, funds transfer fraud and social engineering can sit in a cyber policy, a crime policy, an endorsement or nowhere, depending on the wording and the facts. Public REITs also carry separate SEC disclosure duties for material cyber incidents. The answer for any one REIT turns on its data, systems, vendors, payment controls, contracts, state laws and policy terms.

What cyber risks does a REIT actually face?

A REIT holds more personal information than its balance sheet suggests. Leasing files, resident portals, rent payments, payroll and investor records all carry data about tenants, residents, employees, investors and vendors. Listed REITs describe that exposure in their own annual reports. AvalonBay Communities' 2024 Form 10-K (opens in a new tab) identifies cyber risk tied to storing members' information and says a security breach could lead to loss, misuse, litigation and liability. Kimco Realty's 2024 Form 10-K (opens in a new tab) says a cyber incident could stop the company from maintaining building systems its tenants rely on.

The second layer is the buildings themselves. Access control, HVAC, elevators, parking and energy management increasingly run on connected operational technology, often called OT, which is separate from the corporate IT network that handles email and accounting. Internet-exposed OT assets, weak remote access, misconfiguration, poor segmentation and an inability to run systems by hand after an incident all raise the risk, according to CISA's operational technology fact sheet (opens in a new tab) dated May 6, 2025.

The third layer is everyone else with a login. Third-party property managers, cloud providers, payment vendors and other service providers can hold REIT data or reach REIT systems. Ransomware can compromise business networks, encrypt infrastructure, disrupt operations and even hide an earlier business email compromise, per the CISA #StopRansomware Guide (opens in a new tab). A useful first step is a written map of what data the REIT holds, which systems run each property, and which outside parties touch either.

What does cyber insurance usually include?

Cyber coverage usually splits into two parts. First-party coverage pays the policyholder's own costs. Third-party coverage responds when someone else claims the REIT harmed them. The NAIC's explanation of first-party coverage (opens in a new tab) lists typical first-party components:

• Legal counsel for notification and regulatory obligations
• Recovery or replacement of lost or stolen data
• Customer notification and call-center services
• Lost income from business interruption
• Crisis management and public relations
• Cyber extortion and fraud
• Forensic investigation
• Fees, fines and penalties related to a cyber incident

Third-party coverage generally addresses liability to others, including consumer payments, litigation, regulatory inquiries, claims, settlements, judgments and certain defamation or intellectual-property allegations. Policies may also be organized around network security liability, privacy liability, regulatory defense, cyber extortion, network business interruption and data-asset protection.

Each of those is a possible component, not a promise. Coverage is insurer-specific and sits under the policy's definitions, exclusions, conditions, retentions and sublimits. Ransom payments and regulatory fines are good examples: they appear on lists of typical components, yet consent requirements, sanctions rules, insurability limits and sublimits can all change the outcome. Most commercial property and general liability policies do not cover cyber risks, per the NAIC (opens in a new tab), so a REIT's existing property program is not a substitute for reading the cyber wording itself.

The market itself is split. U.S. cyber premiums were approximately $7.2 billion in 2022 across standalone and packaged products, according to the NAIC's cybersecurity topic page, updated May 9, 2024. In the market segment shares shown in the NAIC Cyber Insurance Report (opens in a new tab) using 2023 data, domestic surplus lines represented 45%, U.S. admitted insurers 29% and alien surplus lines 26%. Those figures describe the market, not what any REIT would pay, but they explain why a REIT may see a surplus-lines policy offered for cyber.

Does it cover building automation and access-control systems?

A cyber policy covers building systems only if those systems, the loss scenario and any dependencies fall inside the policy wording. Coverage written around corporate IT does not automatically extend to access control, HVAC, elevators, parking, proptech platforms or other OT. Some policies treat these as covered systems, some exclude them, and some treat a vendor-run platform as a dependent system with different terms for business interruption.

That makes an inventory the practical starting point. List each property's connected systems, who operates each one, whether it sits on the REIT's network or a vendor's, and how the property would run if the system went down. CISA's OT guidance stresses separating IT from OT, securing remote access and keeping the ability to operate systems manually, according to its OT fact sheet (opens in a new tab). With that inventory in hand, ask the insurance professional how each system, and each dependent interruption, is treated in the actual policy.

Is wire fraud covered by cyber insurance or crime insurance?

A fraudulent wire is not automatically a cyber claim. Business email compromise, or BEC, is a scam in which criminals compromise legitimate business email accounts through social engineering or computer intrusion to cause unauthorized transfers of funds, according to the FBI's Internet Crime Complaint Center (IC3) (opens in a new tab). For a REIT, the risk shows up around rent collection, acquisitions, construction draws and closings, where a changed wire instruction can look routine.

Three coverage concepts often get blurred together:

• Computer fraud generally concerns fraudulent activity involving a computer that causes a financial loss.
• Funds transfer fraud generally concerns fraudulent instructions that cause a financial institution to move funds from an insured account.
• Social engineering fraud generally involves an authorized employee who is deceived into transferring money or changing payment information.

These are not interchangeable. A cyber policy may include cyber crime, computer and funds transfer fraud, or social engineering coverage, while a commercial crime policy may carry separate insuring agreements for the same ideas. The form, edition, definitions, exclusions, verification requirements and endorsements decide the result, and no coverage answer is possible without the policy and the facts. Ask the insurance professional to identify the exact form, edition, insuring agreement, endorsement and verification condition that would apply to a fraudulent wire, and whether social engineering carries its own sublimit.

Speed matters after a bad transfer. IC3 lays out the order:

1. Contact the originating financial institution as soon as the fraud is recognized, request a recall or reversal, and ask for a Hold Harmless Letter or Letter of Indemnity.
2. File a detailed complaint at ic3.gov (opens in a new tab), including the banking information.
3. Provide transaction details promptly so the Recovery Asset Team can attempt the Financial Fraud Kill Chain process.

The Domestic Financial Fraud Kill Chain (opens in a new tab) connects the victim, IC3, financial institutions and FBI field offices to help freeze funds in qualifying cases. It does not guarantee recovery. The scale is real: the 2024 IC3 Internet Crime Report (opens in a new tab) lists BEC losses of $361,651,832 reported by victims aged 50 to 59 alone, and real estate losses of $22,466,504 in that same age group. Those are complaint figures by age group, not an estimate of all losses and not a REIT statistic.

What must a public REIT disclose after a cyber incident?

SEC disclosure is a separate duty from insurance, and having a policy does not change it. SEC Release No. 33-11216 (opens in a new tab), issued July 26, 2023, added two requirements for public companies.

Form 8-K Item 1.05 requires disclosure of a material cybersecurity incident within four business days after the registrant determines the incident is material, subject to the rule's limited delay provision. The filing covers the incident's material aspects, including its nature, scope and timing, and its impact or reasonably likely impact. Regulation S-K Item 106 requires annual disclosure of the processes for assessing, identifying and managing material cybersecurity risks (Item 106(b)) and of board oversight and management's role (Item 106(c)).

The rules took effect September 5, 2023. Item 106 applied to fiscal years ending on or after December 15, 2023. Companies other than smaller reporting companies began Item 1.05 compliance on December 18, 2023, and smaller reporting companies began on June 15, 2024, according to the SEC's small-business compliance guide (opens in a new tab).

The resulting filings show how differently REITs describe cyber risk. Prologis' 2024 Form 10-K (opens in a new tab) says its Audit Committee oversees cybersecurity risk and that it maintains standalone cybersecurity insurance. Kimco's 2024 Form 10-K says insurance may not cover all losses, including investigation, forensic analysis, legal advice, public relations, and system repair or replacement. Those statements describe each company's own program; they do not establish that any policy covers any particular loss. A REIT's materiality decision belongs to the REIT and its counsel under the SEC rules.

Which breach-notification rules may apply to tenant and resident data?

State breach laws follow the residents whose data was exposed, so a REIT with properties in several states may face several deadlines after one incident. Three examples show how much the rules differ.

In Connecticut, Conn. Gen. Stat. § 36a-701b (opens in a new tab) applies to anyone who owns, licenses or maintains computerized data containing personal information. Notice to residents is due without unreasonable delay and no later than 60 days after discovery, and the Connecticut Attorney General must be notified no later than residents are. If a Social Security number or taxpayer identification number was compromised, the statute requires 24 months of credit monitoring, per the Connecticut Attorney General's breach-reporting page (opens in a new tab).

In New York, General Business Law § 899-aa (opens in a new tab) requires notice in the most expedient time possible and without unreasonable delay, and the current statute sets an outside limit of 30 days after discovery, subject to law-enforcement and investigation exceptions. When New York residents are notified, the business must also notify the Attorney General, the Department of State, the Division of State Police and the Department of Financial Services about the timing, content and distribution of the notice.

In California, Civil Code § 1798.82 (opens in a new tab) requires a business that owns or licenses computerized personal information to notify affected California residents in the most expedient time possible and without unreasonable delay, subject to law-enforcement and system-restoration needs. The provision sets no general fixed number of days.

Ask the insurance professional whether notification costs, credit monitoring and regulatory defense are included, and whether they share a sublimit.

What security controls do authorities emphasize?

Insurance does not replace security controls, and insurers may require strong controls as a condition of coverage, per the NAIC. CISA's guidance points to a consistent set of practices:

• Multifactor authentication, preferably phishing-resistant MFA, on email, remote access and privileged accounts
• Strong, unique passwords and protection of privileged accounts
• Prompt patching of operating systems, applications, firmware and internet-facing systems
• Frequent, offline, isolated and tested backups
• Logging and monitoring of remote access and administrative activity
• Secure remote access through private networks or VPNs, least privilege and disabled dormant accounts
• Network segmentation, including separation of IT and OT
• Incident-response plans exercised with IT, security and operations teams
• Manual operating capability and tested fail-safe procedures for OT
• Security review of vendors and managed service providers

Those controls come from the #StopRansomware Guide (opens in a new tab), CISA's OT fact sheet (opens in a new tab) and its joint advisory on critical infrastructure (opens in a new tab) from January 11, 2022. Documenting which ones are in place at the corporate level and at each property, including vendor-run systems, makes a renewal application faster and more accurate.

What should a REIT ask before buying or renewing coverage?

The most useful questions turn the exposure map into policy language. Bring these to the insurance professional:

• Which entities, subsidiaries, joint ventures, property managers and vendors are insured?
• Does the policy cover tenant, resident, employee, investor and vendor information?
• Are building automation, access-control, HVAC, elevator, parking and other OT systems included?
• Does coverage apply to dependent business interruption, and what is the waiting period?
• How does the policy define computer fraud, funds transfer fraud and social engineering, and is fraudulent-wire coverage in cyber, crime or an endorsement?
• What verification procedures are required before a transfer?
• What exclusions apply to known vulnerabilities, unsupported systems, prior incidents, war, sanctions or unapproved payments?
• What are the retention, sublimits and consent requirements?
• Which incident-response vendors may be used, and what notice must be given and how quickly?
• Are regulatory defense, notification, credit monitoring, forensic services and data restoration included?
• What security controls must be maintained as a condition of coverage?
• How does the policy coordinate with crime, property, business interruption, D&O and vendor policies?

It also helps to assemble the paperwork before the conversation: a data inventory, a map of corporate IT and building OT, a list of property managers and service providers, documentation of MFA, backups, patching, segmentation, logging and incident response, the existing cyber, crime, property, business interruption and D&O policies, prior applications, claims and incident history, key contracts and security questionnaires, wire-verification procedures, the states where residents live, and the REIT's SEC reporting status. Any cyber insurance requirement from a lender, joint-venture partner or contract should be confirmed in the loan, joint-venture or contract documents themselves.

Frequently asked questions

Does REIT cyber insurance cover a property manager's mistake?

It depends on who is insured and how the policy treats vendors. Ask whether the property manager is an insured, whether incidents at a service provider trigger coverage, and how the policy coordinates with the manager's own insurance.

Does cyber insurance pay for lost rent after ransomware?

Network business interruption is a common cyber component, but the waiting period, the definition of covered systems and any dependent-system terms decide what a claim looks like. Ask how lost income is calculated and whether a vendor-run system outage counts.

What evidence should be preserved after an incident?

Preserve logs, emails, wire records and system images, and report the incident under the policy's notice provisions. Ask the insurance professional in advance what the notice and consent rules require, since some policies limit which incident-response vendors may be used.

Is a standalone cyber policy different from cyber coverage in a package policy?

Yes, cyber is sold both as standalone policies and as coverage packaged with other lines, according to the NAIC's market reporting. Limits, sublimits and the scope of first-party and third-party coverage can differ, so compare the actual wording side by side.

Your next step

Start with the exposure map: the data you hold, the systems that run each property, the vendors who touch either, and the policies you already carry. Then take the questions above to an insurance agency that works with commercial real estate and ask to see the wording behind every answer. Riskado's directory lists insurance agencies across the US, so you can find one to speak with and check its license with your state insurance department (opens in a new tab) before you share details.