Potentially sensitive customer information allegedly stolen from Melbourne real estate agency Nelson Alexander
Some personal data could be at risk following an alleged robbery at a Nelson Alexander office. (ABC News: Jesse Thompson)
In short:
Melbourne real estate agency Nelson Alexander says information related to 89 historical tenancies was allegedly stolen from its office in the city's inner-north last month.
Affected landlords and renters were told the information may have included names, numbers and identity documents.
What's next?
A 40-year-old man is due to face court next year.
Authorities are investigating the alleged theft of potentially sensitive information related to scores of renters and landlords during a mysterious nighttime robbery at a Melbourne real estate agency.
The information stored in five boxes was allegedly stolen during a break-in at Nelson Alexander’s Northcote office about 10:30pm on October 26.
A Victoria Police spokesperson said a 40-year-old man from Fitzroy North had since been charged with handling stolen goods, and some of the documents had been recovered.
The man is due to face court early next year.
The boxes, which the agency said contained material which was in the process of being scanned then destroyed, held information related to 89 historical rental files.
Police are investigating the theft. (ABC News: Jesse Thompson)
Amy, a former renter with Nelson Alexander, said she received an email about the breach about a fortnight later.
It warned details like names, addresses, phone numbers, dates of birth, tenancy ledgers and possibly identity documents like licences may have been stolen.
"You should carefully review the information that was affected by this incident and consider whether this could result in you experiencing any harm," the email said.
Amy described the breach as frustrating but added that she was no longer a renter with Nelson Alexander, so it was difficult to know whether any of her information was current.
"It dawned on me a week later that I actually haven't been with that real estate agent for about eight years,"she said.
"I actually got in touch to find out what their data retention policy was and [they] told me they tend to keep things for seven years."
In Victoria, real estate agencies are required to retain sensitive information for seven years.
The Real Estate Institute of Victoria said agencies were permitted to destroy that material afterwards, but they could also retain it as long as it was stored securely.
Data protection advocates say real estate businesses are targeted because they hold lots of personal information. (Four Corners)
The ABC has given Amy a pseudonym to protect her identity, in light of the privacy breach.
She said her data had potentially been compromised twice in about 12 months given she was affected by an attack on a pathology lab late in 2023.
"It's frustrating when you get those emails to say your data's potentially breached and there seem to be no consequences for that," she said.
"I just felt frustrated."
Nelson Alexander said it took data storage seriously and self-reported the incident to the federal privacy watchdog, the Office of the Australian Information Commissioner.
"All of our current rental data is stored with digital/cloud technology providers behind strict security protocols, complex passwords, MFA [multi-factor authentication] and SSO [single sign-on] where possible," a spokesperson said.
The agency said it worked with industry providers "to ensure our customer data is protected to the highest level".
A police investigation is continuing.
Broader push for limit on data retention
A number of real estate agencies have fallen victim to cyber attacks targeting customer information in recent years.
Privacy advocates say the significant amount of personal information generally required to apply for a rental made that data a valuable target.
"It is a really complete picture of somebody’s life," Samantha Floreani, a Digital Rights Watch advocate who specialises in real estate data privacy, said.
"One of the key things that should be done in Victoria and Australia more broadly is to be mandating data retention periods to make sure that real estate agencies are not sitting on big troves of sensitive and personal information for as long as they would like."