Why HOAs/COAs Need to Take Computer Security Seriously

It isn't just the obvious targets that get hit:

Ransomware attack exposed personal info of Hancock unit owners

Thanks for the link. There have been a number of discussions about HOA files and storing them on private drives, the cloud, etc., and while this is very convenient, we sometimes forget there are folks who are VERY GOOD at hacking - if they can get into the Pentagon, why not an HOA property management company? Or a HOA board president might accidentally click on a strange link and presto, you have malware.

This, boys and girls, is why careful thought is vital when considering HOA records (or your own personal records for that matter). It's not just about the "is this legal?" questions.

(Hey, haven't I said this already???)

In this case it was the property management company that got hit, not board members' personal computers or cloud accounts. This is why I suggested including security as something we should look at when evaluating a PM.

Usually when companies get hit by ransomware, the big danger is that they lose essential information. It can mean that the info is permanently gone (if they didn't back up their data regularly, for example). Or they can be out of commission while they recover the info they need to do business. The effects can range from nuisance to permanent damage.

There is also the risk that an owner whose personal info was compromised and who experiences identity theft may decide to sue the HOA. Even if the person can't prove that the identity theft resulted from a particular data breach, the HOA still needs to spend money dealing with the lawsuit. I bet insurers were also be looking at this as well.

Would,'t the PMC be the one on the hook? Granted the HOA would be put #1 on the blueback, but during pre trial stage, evidence would point to the PMC. NRS 603A was passed several years ago that places a duty to protect sensitive information on the parties responsible for safeguarding them.

I own a PM company, but don't store the same documents that the PM company in the article mentioned. I manage HOA only, never have managed rentals, which is where some of the information stolen might come from. SS# and credit reports of lease agreements would be keep. There is nothing I keep that would be of any value to a hacker. The software I use has there data security and to date, never been hacked.

Yes, they look for personally identifiable info that they can sell to bad guys - the bad guys can use this data for further attempts at intrusion (emails for phishing attempts or outright identity theft, for instance). But ransomware also locks up a business's data by encrypting it - this provides a quick payoff if the business pays the ransom, and if not they just move on to the next target. Even if only tiny percentage of victims pays anything, it generates enough profit for the bad actors to keep at it since there seems to be an endless supply of folks who fall for phishing attempts. It's big business for bad guys, and they're good at it.

My employer is diligent about training their people. In addition to required annual security training for everyone, we get regular reminders and warnings from IT and they periodically send fake phishing emails to see who clicks on the links (those who do get extra training). It's often the weak links that provide the most opportunity for crooks.

I push my HOA payments through my Bank. Our MC charges around 4% for credit card payments processed through the owner-to-bank online payment portal. Credit card information is captured on the bank end. Check payments are mailed to a bank lock box. Only check payments received by the local office in person could cause some concern.

They also offer pulled ACH drafts. I don't do ACH drafts for anything can't I can't log-in and control. Our MC requires that any changes to ACH drafts be mailed and can take 3 days to take effect. Mail in NC has taken up to a month to be received.

Our MC does not handle rentals, therefore no private information like credit reports or S.S.'s are gathered. Names, addresses, email addresses and phone numbers, when provided by owner, are all that are stored.