Can You Afford NOT to Pay for Cyber Security?

Last month, the credit-reporting agency Equifax announced that it had fallen victim to a data breach, in which cyber thieves stole the sensitive data of more than 140 million Americans. It was only the latest episode in a widespread cyber crime wave, and it’s pushing forward-thinking co-op and condo boards to implement protective measures.

“Ten years ago, everything was stored on a local hard disk,” says Steve Rosenstein, the co-op treasurer of 60 Pineapple Street in Brooklyn Heights. “That’s changing now.”

Rosenstein recently retired from IBM, where he designed programs that reduced the risk of data breach. He says the reason co-ops and condos are more vulnerable to data breaches now is two-fold: an industry trend towards cloud-based file storage, in which sensitive data is kept online rather than in offline computers or filing cabinets; and the decreasing price of powerful computers, which hackers can use to decrypt weakly encrypted files.

Data breaches can be disastrous to co-ops and condos. If an applicant were to steal a co-op’s monthly financial report and discover mortgage troubles, they might low-ball their bid to take advantage. Shareholders could lose sensitive information like Social Security numbers or bank records in a breach, which, in turn, could spur litigation. In one recent post on Habitat’s online Board Talk forum, a board member reported that the co-op’s management company had inadvertently delivered the monthly financials of another property to the board, including rent rolls, shareholder names, full addresses, statement balances, plus all of the co-op’s bank account numbers. And it wasn’t the first such slip. 

What should a co-op or condo board do? At the very least, encrypt the sensitive digital data it shares with its property manager.

That can be difficult for the property management industry, where “it’s still 1985,” according to Mark Levine, an owner of the management group EBMG. To encrypt its data, EBMG uses DropBox, a file-hosting website that charges his company $100 a year for a terabyte of online storage space. That annual payment stores and helps protect the documents of the approximately 100 buildings that EBMG manages.

With DropBox, only users on an access list can log on and view files. And although Levine says that some board members still ask for files to be sent by mail, more and more are getting on board. “It’s shifting,” he says of resistance to new technology. “The old guard really isn’t there that was there 15 years ago.”

For those looking to spend even less, Rosenstein says that sensitive files can be zipped – that is, compressed and bundled – and then password-encrypted using such programs as 7-Zip or WinZip, which can be downloaded free online. Once files are zipped, they can be unzipped and read only by password-equipped users. 

And then there’s the matter of cyber liability insurance, an affordable protective measure that’s becoming more commonplace. Leonor Vivona, an associate vice president at FS Insurance Brokers, the in-house insurance brokerage for FirstService Residential, says a few carriers began to offer cyber liability insurance on a stand-alone basis in the last few years, and clients have increasingly shown interest in purchasing the policy. 

The typical policy covers the cost of hiring an attorney to defend against lawsuits brought against the corporation after a breach. It also covers notification costs, which could be phone calls or a mass mailing to all potentially affected parties, as well as crisis management – setting up a call center where concerned parties can get more information; paying for credit monitoring for anyone affected; and public relations to help a co-op, condo, or management company rebuild its reputation after a breach. And finally, if a board is hit with fines, the policy will help cover those costs as well. 

“If you’d told me about cyber liability in 1998, I wouldn’t even have known what ‘cyber’ meant,” says Levine. “But it’s a changing world.”