Ransomware Reporting Adds a New Layer to Agency Risk Planning

For agencies, the exposure is easy to underestimate. Sales teams, administrators and property managers routinely handle identity documents, tenancy applications, bank details, contracts, property access information and confidential negotiations. If that information is encrypted, stolen or threatened with release, the immediate pressure can be intense. Decisions about whether to pay, how to restore systems, when to notify affected people and how to preserve evidence may all happen before the agency has fully understood its insurance position.

This is where policy wording matters. A cyber policy may provide access to incident response specialists, forensic IT support, legal advice, notification assistance, public relations support and cover for certain interruption costs. However, ransom or extortion-related benefits are usually subject to strict conditions, exclusions and insurer consent requirements. Paying quickly without involving the insurer or approved response panel may create problems later, even if the agency was acting under pressure.

Real estate principals should use the reporting regime as a prompt to test their incident response arrangements. Practical questions include:

• Who has authority to make urgent cyber incident decisions if the principal is unavailable?
• Where are insurer emergency contact details stored if email and office systems are locked?
• Does the agency know whether its turnover, group structure or related entities bring it within reporting obligations?
• Are staff trained to escalate suspicious emails, compromised logins and payment redirection attempts quickly?
• Has the agency reviewed how cyber cover interacts with professional indemnity, crime, business interruption and management liability policies?

The insurance lesson is not simply to buy more cover. It is to align cover, contracts, technology controls and response procedures before an incident occurs. Agencies should confirm notification timeframes, consent requirements, excesses, sub-limits and exclusions, particularly where outsourced IT providers, cloud software and trust account workflows are involved.

Ransomware reporting also reinforces the importance of documentation. If an agency ever needs to explain a payment decision, lodge a claim or respond to regulator questions, clear records of advice received, steps taken and approvals obtained can make a difficult event more manageable. In a sector built on trust, preparedness is now part of client protection.