Estate agent cyber attacks and incidents affecting other UK property businesses rose by 17% last year. Criminals are increasingly targeting the financial and personal data held by agencies.
There were 208 reported incidents in 2025, up from 178 a year earlier. The figures come from Information Commissioner’s Office (ICO) data analysed by Karis Insurance.
The increase highlights the risks facing agencies that handle sensitive information during sales, lettings and property management.
Agents routinely collect passports and driving licences for anti-money laundering and identity checks. Their files can also contain addresses, bank details, mortgage information and tenancy records.
That combination can make property businesses an attractive target for cyber criminals.
Criminals can use stolen information for identity theft or sell it to others. They can also use ransomware to block access to systems or data and demand payment.
Property transactions present another potentially costly vulnerability.
Criminals can use compromised emails or transaction information to carry out payment diversion fraud. They typically replace legitimate bank details with their own to redirect money.
A successful attack can affect more than an agency’s customers. Businesses can face financial losses, disruption and reputational damage.
Ravi Sejpal, director of insurance at Karis Insurance, said: “In many cases, property businesses hold just as much detail about their client base as a bank would.
“However there are very few businesses in the property sector who have bank-level data security arrangements.
“The sort of personal data that property agencies hold about their clients could be hugely valuable if it fell into the wrong hands. These figures show that hackers are increasingly realising that.”
Karis also points to the affluent and high-net-worth clients represented by some property businesses. Their data could provide another attraction for criminals.
The volume of information moving through the sector is also growing. More elements of property transactions and lettings now take place digitally.
Karis argues that agencies need to assess how they protect customer information. Businesses also need plans for responding when criminals compromise their systems.
Sejpal said: “Every financial services business and law firm involved in property long ago understood the risks posed by hackers, which can be business-critical for those affected.
“The property industry itself hasn’t quite moved at the same pace in getting on top of the risks, however.”
He added that businesses should consider specialist insurance covering data breaches and cyber incidents.
The property industry continues to increase its reliance on digital systems for transactions, customer verification and management. That creates a growing volume of sensitive information for businesses to protect.
