Podcast - Cyber Risk in Real Estate and Auto Dealerships

Kyla Baker: My name is Kyla Baker, and I am a commercial real estate attorney out of our firm's Atlanta office. We are here today to talk about cyber risk in real estate and automotive dealerships. With me today are Matt Welling and Neda Shaheen. And I will turn it over to them to introduce themselves in a moment. But before I do, I wanted to give some context as to why we're here today. We're here because cyber incidents are happening all around us and definitely have impacted both real estate and automotive industries. In the last couple of years, we've had a major software company outage that resulted in delays of M&A transactions for multiple months. And we're also seeing, very frequently, instances of wire fraud, where that also has not only resulted in serious losses but delays as well in those transactions. And we're hoping today we can share some insight with you about how to prepare and react to these situations because they're happening all around us. So with that, I will turn it over to Neda to introduce herself.

Neda Shaheen: Hi, everyone. My name is Neda Shaheen. I'm an associate on the Data [Strategy, Security] & Privacy Group at Holland & Knight. I am excited to be here with my colleague, Matt Welling.

Matthew Welling: Hi, this is Matt Welling. I'm a D.C.-based partner in Holland & Knight's Data Strategy, Security & Privacy Group. And my practice focuses on working with companies as they're navigating these incidents when they happen, as well as the preparedness side. So, getting ready for them to occur. I've been in this space for over a decade. We'll talk about how long over a decade at this point. I spend a lot of time here, and Neda and I are both deeply engaged, not just on the legal side of it, but also with technical teams. And just to establish my credentials, I guess, a little bit in that end of the forest, I teach at Johns Hopkins, their Information Security Institute, kind of working on these issues, and have an advisory role at Indiana University as well, in addition to my work with the firm. Nice to be here.

Kyla Baker: Thank you both for joining me. So first, let's talk about why these real estate and automotive industries are targets.

Neda Shaheen: And also, just kind of to set the stage a bit, I was really happy when we started the call that you called it an incident. Matt and I were just talking about the importance of making sure to call these incidents instead of data breaches, because data breaching has specific definitions in certain states, and that can open you up to additional cyber risks. And also, as we think about that, just keeping in mind that cyber risk right now is at an all-time high. The cost of an incident in 2025 has reached a global average of about $4.4 million. And with that, cybercrime is also projected to cost the world about $10.5 trillion in 2026. That value is expected to grow by 15 percent annually over the next five years. And so we know that these are becoming much more severe, much more accelerated. They're a lot more frequent, and it's an enormous, enormous enterprise. It's highly organized, highly sophisticated. And so when we think about it in the context of real estate, property management, auto dealerships, these are really sitting at the perfect intersection of money, data and urgency. They're high-value transactions. There's lots of personal data that's involved. There's also fast-moving deals, they want the deal to go through. And there are lots of moving parts and multiple parties. Matt, I don't know if you also want to add some context to that.

Matthew Welling: And those are just features that we see recurring in a lot of the incidents that we're dealing with where you have, in some cases, truly large sums of money, but in all of these, sums of money that are meaningful to the individuals or the parties involved, and it's changing hands among parties that may not do business with each other day in, day out. So they're trusted because of who that other party is or what industry they're in. But there is not necessarily the same familiarity that's built into some other industries where funds may be changing hands. And that can make them a ripe target to threat actors.

Kyla Baker: Thanks so much for that description of what we're dealing with. I think that is really helpful. What can you share with us about the anatomy of how an incident occurs and kind of the life cycle of that?

Matthew Welling: So in this industry, really in most industries, I would say that the most frequent types we see are some version of business email compromise. So an unauthorized party has gotten into an email account they shouldn't. And then, you know, taking advantage of that, either through phishing, [wide] spreading, fraudulent wire instructions, whatever it may be, extracting data, stealing it. That's probably the most common that we run into. Ransomware is one that still makes the news, and just really extortion more broadly. So it doesn't always just look like your network's been encrypted anymore. Often it's data theft and then extorting the victim to either prevent it leaking or posting on a leak site or selling it, all the other things you can do with it, but then also into more bespoke things that look more like nation-state activities or espionage, as well as taking kind of all of those events and then putting them out into a company's supply chain so their vendors experience it, a counterparty experiences it, that sort of thing. Out of all that, there are going to be some common features, and that's going to be that somebody is going to notice that it happened. And this is one of the places where we often see organizations not be as prepared as they think they might be, because they will build their processes around discovery by, say, their security tools, which is a good thing. But it can come in other ways, too. It could be another party tells you that they've experienced the incident. It could be an employee who has seen some unusual behavior either in their email or with your systems or from another party. It can be a notification from law enforcement or just some other third party that you weren't expecting, and the list goes on. So as organizations are preparing for this, it's to prepare that this first indication that something has happened could come through a number of different channels.

And then what do you do with it? So, you know, the incident has occurred, there is some impact, there's some unauthorized access, or systems are unavailable, what have you. From a threat actor standpoint, they have some goal, and it's important to try to get your arms around what is the scope in terms of what your impacts are, in terms of systems that are unavailable or access that shouldn't be there. And then to try to understand what's occurring, right? If it's an encryption event that's spreading, do you have the opportunity to stop it somehow? If somebody is trying to steal data, do you have the ability to cut it off or to remove that access? Whatever it is. And that's getting to what we call containment, and that's more the technical end of things. And then the next step would be eradication, getting those unauthorized actors out of your system. And then we get into the investigation, recovery and mitigation, all the other things that can come down the pike. And I think the important thing to highlight is often this process doesn't take hours or even days. It can take weeks or longer, depending on the scope of what's occurred and getting back to a sense of what safe looks like. But those are kind of some of the big steps.

There are some very good documents out there from the National Institute of Standards and Technology (NIST), who has a very basic document everybody often goes to across industries, which is NIST 861, is the document anybody can go look at. And for those who are interested in how to think about it from the threat actor side, there's a document called the [Cyber Kill Chain] that if you put either of those into Google, you'll get to them very quickly.

Kyla Baker: So, switching over to more practical things for our clients and contacts to be thinking about, what can they do to prevent these incidents or have in place before so that they're prepared to respond?

Neda Shaheen: So on this side, we're the legal part. There's so many moving pieces to that when you're thinking about it technically, as well as from a governance standard. We look at it from the governance side, and keeping your incident response plans up to date, making sure you're practicing it often, having clear roles, decision-making structures is important, making sure your policies and procedures are up to date, and that the team is working cohesively. One of the things we're finding more and more often is that cyber risk isn't just up to your IT team, it's an entire organization's responsibility. Every person in the organization has a role to play in that, especially when you think about the idea of a phishing incident. It doesn't need to be the CEO that clicks on that link for somebody to then be able to access your systems. That's just the entry point that then can trickle down to the rest of it. So think about it in the cyber governance standard and plan ahead. And then also important to that is to consider the technical basics and to work with your technical team to make sure that the policies and procedures are implemented, that there's the same understanding around authentication, patch management, around the systems monitoring, things that your employees are allowed to click in and out of or that those involved in the deal should be, what they should be expecting. One of the biggest things with the business email wire fraud, for example, is if you don't know who's sending you something or you see an email that looks like it might be from this person, but you're not sure it's from this person, to make sure you confirm who you're talking to and pick up a phone and call and confirm those communications. And I'll turn it to Matt if you have additional things to add to that.

Matthew Welling: Yeah, I think one of the best tools that organizations can use to prepare is to practice. We call it a tabletop exercise, right, because it gets its name from people literally sitting around a table and stepping through what they would do in one of these circumstances. And we're often working with companies to do these under privilege and map learnings out of it as they're preparing for these events. But really any organization can work on it. And there are some statistics behind it that show that organizations, they don't just have a plan, but they practice that plan, see significant savings in terms of their costs when an incident occurs. I think the other thing is to be mindful of what your organization looks like, how large it is, how mature it is in this space. And as you're building your plans and practicing them, to keep in mind not just what a supposed ideal plan might be out there, but what's realistic for your organization. So if something happens, that you can realistically achieve it to make sure that you're then following the plan that you have. Because having what on paper may seem like a great plan, but it's just totally unrealistic for people to follow because of resources or personnel or whatever can, on its own, create risks. So it's not just having a great plan, but a plan that you follow and then practice it.

Neda Shaheen: And one thing I would add to that, which Matt, you can also talk about, is the third-party risk that's involved. Organizations should know their vendors. They should understand the third-party risks that can lead to some of those attacks that we hear of, the big supply chain attacks, right? Where you have a specific program or system that becomes updated, but that update includes some type of vulnerability in it and now it leads to a bigger situation. So understanding the third-party risk, knowing your contractual obligations, what protections are there, what liabilities are there. That's, I think, another important step that lawyers can help with in this space.

Kyla Baker: That's so true because I know that in our work we engage with so many different vendors to get a deal across the finish line, and we try our best to remind them of the confidentiality and that sensitivity of the information. But there's a certain degree of making sure that the vendor that you're using is a professional and good fit and being aware of the possibility and very real threat of these incidents. So that's a good thing to keep in mind for sure. What about if and when something happens? What should we be thinking about as our first step when we notice that a cyber incident may have occurred?

Matthew Welling: The first step, hopefully, is to get out your incident response plan and start following that. But kind of stepping back is understanding not necessarily every organization has one of those yet. We hope everybody's working toward it. But it's to make sure that the right people are involved. Where we often see organizations maybe kind of get down a path that can be more problematic is they don't have all the right people around the table. And understanding it's not just a technical issue, it's not just a financial issue, it's not just an operations issue, right? It's all of those pieces, that cyber risk is really enterprise risk in many ways and that companies treat it as such. No different than other kinds of higher-level operational risks that they have that will involve different and appropriate stakeholders from the company. As a starting point or kind of rule of thumb is there should be technical owners. There should probably be legal or compliance, you know, somebody from that function, because that can help contextualize the risks of the company. And then leadership from the part or parts of the business that have been impacted. Those are good starting points, and then you can triage it and understand sort of what's going on.

I think the one thing I would flag is, as that's occurring, to understand how you're communicating. So if your email has been impacted, be thoughtful about if your email can be trusted to have those conversations. And this is a good point for, as you're planning, what is your backup communications channel, and not just can you use it. Is it secure, but also do you have the ability to retain evidence out of that? Because we are in a world where these issues can lead to legal risk, which can lead to litigation or regulatory investigations where you may be asked to have records of those communications, if they're written, that you've retained them. So it's a good point to plan for sort of what is your backup communications channel. And here, I just want to highlight that for a lot of organizations, their email, their messaging, their phone, all of that is integrated and federated now, right? It may just be different servers in their data center, maybe not even different servers. So having some channel that you can all go to securely outside of that, somewhere in your plan, is a good thing. So it's getting the right people around the table and then being able to communicate with them.

Neda Shaheen: There's a really good quote that I like connected to that, that is, "when the pressure is on, you don't rise to the occasion, you fall to the level of preparation." And I think that's really true in this context when Matt talks about having that plan and practicing across the table with everyone in place.

Kyla Baker: One question I have hearing you guys talk about this is, you know, we have clients that are big companies, but we also have some kind of smaller shops. Is there any difference in preparation that we should be thinking of depending on the size of the business involved?

Matthew Welling: I think it's understanding your organization as you're preparing, right? We've built plans for very small early-stage startups, for example, where in a nutshell, every step of triage is, if you see something, call the CEO, because there's three people in a garage. You're not going to have a lot of formality and a lot of process because it doesn't fit the organization. So for smaller organizations, it may really be something that looks like that, right? If you have a relatively limited number of employees or at least kind of responsible employees, it may always just be to get that group together, that that's going to be, net-net, the most efficient path. I mean, this goes back to the point I mentioned earlier, which is an aspirational plan can be just as harmful as a bad plan because it doesn't fit your organization. So having some beautiful plan on paper that is completely unrealistic for your team to be able to follow can be just as risky. So as you're preparing, it's understanding your organization, understanding your size, understanding where your capabilities are, and taking that all into account. Because we always talk about this as kind of crawl, walk, run. That if this is the first time you're thinking about this, the first you're planning for it, you only have an office or two, you don't need to have something that's on the scale of these kind of large national or even multinational organizations. It's going to be a different fit, and that's OK. It's just having a plan, having that plan work for you, having practiced it and having the people that are involved in it know that they're a part of it and know their roles. That's going to be some of the keys to success.

Kyla Baker: Is there anything that you guys think that we should make sure our client contacts know that we haven't talked about today?

Matthew Welling: Yeah, just to be a little self-serving, call your lawyers. We should put that in there somewhere. And that can be your in-house lawyers. It doesn't have to be us or other competent outside counsel. But one of the things that hasn't always changed is understanding the lawyers aren't just the fun police here. Their job is to help protect the organization, help protect the members of the technical teams. It's really to help translate the risks of the company into action and help provide direction in this to protect everyone involved as best they can, to help retain information and really kind of bring in the protections of privilege where they apply. So I think the one thing we didn't touch on, and we try not to be too self-serving here, but to call your lawyers. We can really be of a lot of assistance here and especially in our role as outside counsel. We have the benefit of doing this at volume, that we can help bring in those lessons that we're experiencing across all the different organizations we work with, where this might be your worst day and we're very mindful of that. It may be an issue that we've dealt with multiple times. Multiple times this week, in some cases. And we can help navigate and help share out of all those other experiences to help you navigate even more effectively for your organization.

Neda Shaheen: Yeah, and I would agree with Matt. Call your lawyer, and not just when it happens, but also before. As we said, a big part of it is preparation. So the difference between a manageable event and a crisis is really what happened before the incident occurred.

Kyla Baker: Well, thank you both for joining me today for this discussion. We know that cyber risk is an ongoing thing that is not going away, especially with implementation of AI and other tools that businesses are incorporating every day. And we encourage you all to think proactively about your cyber risk and plan ahead. And feel free to reach out to anyone on this call if you have any follow-up questions. Thank you guys so much for joining me today.