Tech & Cybersecurity: A Whole New Ball Game for REITs

June 2017

Technology risk has been a persistent thorn in REITs’ sides, as operational and competitive threats penetrate every segment of the real estate market.

From an operational perspective, REITs’ reliance on their information systems and technology has grown significantly. Ensuring the right systems are in place and keeping them in working order are top priorities in 2017. Almost 3 in 4 REITs (72 percent) cite operational risks associated with the implementation and maintenance of technology and systems, consistent with prior years. 

With greater reliance on technology comes increased cyber risks, and more than 9 in 10 REITs (92 percent) identify cybersecurity as a threat in their disclosures, up from just 25 percent in 2012. 
The May 12 WannaCry ransomware attack stands out as just one example of how cyberattacks can spread like wildfire across industries and international borders. The ransomware program hit organizations around the world, including an estimated 3,300 infections in North America.

A variety of cyber threats, including phishing scams, ransomware attacks, distributed denial of service (DDoS) and permanent denial of service (PDoS), could wreak havoc on REITs. Recent strides have been made by the industry —to automate processes, install Internet-connected equipment and devices into properties, and transition management and accounting software to the cloud—that have introduced a host of new cyber risks. Furthermore, the threat of attack doesn’t end with REITs’ own IT systems: Threat actors can exploit vulnerabilities that lie with REITs’ tenants or third-party vendors, managers or franchisors. 


Which Tenants are Hackers Targeting? 

Hackers can exploit valuable data from virtually any business, but certain industries—like healthcare—are prime targets for cyberattacks. The industry houses highly valuable bulk datasets of patient health records, personally identifiable information and payment information, as well as connected medical devices. It’s no surprise that healthcare REITs unanimously identify data breaches as a risk. 

Cyber is a concern in the retail and hospitality sectors as well: All retail REITs and 93 percent of hospitality REITs cite cybersecurity as a risk in their 10-K filings. Hackers often target credit card processing and point of sale (POS) systems to steal credit card information. While most hospitality REITs have cybersecurity on their radar, the data suggests they could be underestimating it still. According to Verizon’s 2017 Data Breach Investigations Report, the accommodation industry—which encompasses restaurants as well as traditional hospitality players like hotels—experienced 201 data breaches in 2016, over half of which were POS breaches. 


There’s an App for That: The Gig and Sharing Economy 

Startups like Airbnb, WeWork and Breather are bringing the sharing economy to the real estate sector, leaving a wave of disruption in their wake. Whether it’s a platform for services, deliveries, ride-hailing or home- and office-sharing, most share certain key features, including transparent ratings systems and in-app payments. The name of the game has become instant gratification: Space sharing and growing demand for shorter-term commitments are shaping the future for the retail, hospitality, office, apartment and timeshare sectors. 


“The biggest cybersecurity mistake companies can make is underestimating the likelihood of an attack. In the end, what will separate REITs from their competitors is how well they’re prepared to handle a breach when the inevitable incident hits. Developing a cyber risk management strategy now will pay dividends when companies are faced with live threats in the future." 

REITs-RFR-Web-headshot-circle_Riggi.jpg  John Riggi
  Head of BDO’s Cybersecurity and Financial Crimes Practice


Four out of five hospitality sector REITs (80 percent) cite the growing popularity of third-party intermediaries—like Travelocity and TripAdvisor—as a risk to their business. Most said the biggest risk posed by these service providers was an impact on brand loyalty. Instead of booking accommodations directly with a hotel brand, many travelers now turn to travel sites to price-check their options and peruse reviews and ratings making it more difficult for hotels to build brand loyalty. 

Eighty percent point to the sharing economy and the proliferation of online rental platforms like Airbnb and VRBO as a threat to their business in the year ahead. This year, several jurisdictions—including New York City—introduced laws regulating online rental platforms. To counter scrutiny and solidify the platform’s legitimacy, Airbnb prioritized establishing tax agreements with 275 jurisdictions, including 5 countries and more than 30 states. 

“Disruptive players in the lodging industry pose a unique set of challenges for hospitality REITs. Unlike REITs focused in other segments, maintaining strong brand loyalty among their customers is a key priority. While rental sharing platforms continue to attract travelers, large, well-established hotel brands have maintained a strong foothold. As the data reflects, maintaining franchise licenses is one of the crucial components for hospitality REITs’ continued success.” 

REITs-RFR-Web-headshot-circle6_LaMalfa.jpgAnthony La Malfa
Partner in BDO’s Real Estate and Hospitality practices


E-Commerce Accelerates, Brick-and-Mortar Retailers Are Wary

REITs operating in the retail industry are keeping a close eye on the rapid growth of e-commerce as it transforms business models and shifts emphasis away from brick-and-mortar stores. Unsurprisingly, more than three-quarters of retail REITs identify e-commerce as a threat to their bottom line. 


“Brick-and-mortar retailers are facing the incredible growth of e-commerce head on. Strategic acquisitions—like Walmart’s purchase of—are a smart play for traditional retailers to stay in the game. Retail REITs are keeping a close eye on how their tenants adapt their business models to remain competitive with these emerging market pressures.”

REITs-RFR-Web-headshot-circle7_Kotlyar.jpgNatalie Kotlyar
Leader of BDO’s Consumer Business practice