The weak link is your service provider

Why can a service provider bring down an entire building?

A building does not run itself. The managing agent (the syndic) relies on a heating contractor, a lift company, a diagnostics surveyor, a software vendor, a managed service provider, a payment collection platform. Each of them holds a key: access to a portal, an account on a shared tool, a database listing the co-owners’ names, sometimes the door code. When one of them is compromised, the building suffers the consequences without having been targeted.

The four cases that follow are documented by primary or first-rank sources: a parliamentary report, stock-market filings, court decisions, notices from authorities, a victim’s statement. Not all of them concern buildings; they show the same mechanism.

Target and Fazio: the heating contractor’s account opens the store network (2013)

Fazio Mechanical Services, of Sharpsburg, Pennsylvania, maintains heating and refrigeration installations; the retail chain Target is one of its customers. According to the report of the United States Senate Committee on Commerce of 26 March 2014, the attacker sent booby-trapped emails to Fazio at least two months before the card data was stolen. Brian Krebs adds that the suspected malware is Citadel, without confirmation, and that the contractor protected itself with the free version of Malwarebytes, whose licence prohibits business use.

The stolen credentials opened Target’s supplier portal, Ariba according to Krebs. Fazio stated that its connection was used exclusively for electronic invoicing, contract submission and project management: the heating contractor was not controlling anything remotely. An access intended for sending invoices served as an entry point, for want of two-factor authentication and of segmentation between the supplier portal and the tills; the exact path from the portal to the tills remains unknown. The first intrusion is dated 12 November 2013 by the New York Times, cited by the Senate, and 15 November by Krebs; card data was collected from 27 November to 15 December, then sent unencrypted, by FTP, to external servers, one of them in Russia.

Target’s detection tools had reacted: alerts from Symantec around 28 November, from FireEye on 30 November, 2 and 3 December. None of them was acted upon. The toll: around 40 million payment cards, 70 million customer records announced by Target on 10 January 2014. The chief executive, Gregg Steinhafel, left the company on 5 May 2014 (filing with the SEC). On 23 May 2017, Target reached an 18.5 million dollar settlement with 46 states and the District of Columbia, together with a security programme: segmentation of the card environment, password rotation, a second factor on certain accounts. No catalogued vulnerability is associated with this case: the sources describe a human and organisational link.

RealPage: an email in Stripe’s name diverts ten million dollars in rent (2018)

RealPage, an American property technology company, acquired in 2017 a business that collects rent on behalf of landlords through the payment platform Stripe. In April 2018, an employee received an email imitating Stripe, clicked and entered their credentials. According to the judgment of the Court of Appeals for the Fifth Circuit of 22 December 2021, those credentials gave access to the disbursement instructions provided to Stripe. The criminals altered them, and Stripe paid out more than ten million dollars to other accounts. The incident, discovered in May 2018, appears in the quarterly report filed with the SEC; HousingWire reported it in January 2020.

A transfer fraud, in other words: whoever controls the account changes where the money goes. The judgment of the federal court for the Northern District of Texas of 5 September 2024 details the amounts: around 9 million dollars in rent owed to landlords and 1 million in transaction fees; 4.5 million recovered quickly; 2,908,130.53 dollars returned by the State after civil forfeiture; 1,231,692.78 dollars paid by the insurer; a net loss of around 6 million. The money had passed through 88 mule accounts in 42 banks. RealPage immediately alerted its banks and the United States Secret Service, which made it possible to freeze 2.9 million, and fully re-credited its customers.

The courts then held that the fraud policy did not cover the customers’ funds, because RealPage did not “hold” them: they were in transit on an account of the payment provider. Only the transaction fees, around one million, were covered. The landlords’ money was most exposed at the precise moment when RealPage’s insurance did not cover it.

CTS and Simplify: the managed service provider goes down, eighty firms come to a halt (2021 and 2023)

In the United Kingdom, the sale of a home goes through specialist firms, the conveyancers, which exchange funds and deeds on the day of completion. On Wednesday 22 November 2023, the clients of the managed service provider CTS lost access to their files, according to TechCrunch. On Friday 24 November, CTS spoke of a “cyber incident”, appointed a forensics firm and said it was unable to give a timetable, The Record reported. Around 80 firms were affected. Buyers could not complete on the planned day, paid for hotels and storage, saw their mortgage offers expire; the press cited a buyer whose exchange was scheduled for 22 November and whose offer was valid until the 30th. One firm, O’Neill Patient, covered its clients’ immediate costs. By the end of December, more than 90% of clients were operational or in final testing according to the trade press (Today’s Conveyancer, 21 December 2023): around one in ten was not, a month on.

The cause has not been confirmed by CTS. One professional, Ian Towner, put forward the hypothesis of an exposed Citrix NetScaler gateway, inherited from Sprout IT, a managed service provider merged with CTS in 2020, and of the vulnerability known as CitrixBleed, CVE-2023-4966. The vulnerability itself is established: the joint advisory from CISA, the FBI, MS-ISAC and the ACSC of 21 November 2023 describes a theft of session tokens on NetScaler gateways that makes it possible to bypass the password and multi-factor authentication, exploited from August 2023, notably by LockBit 3.0 affiliates against Boeing. The advisory recommends patching this type of gateway within 24 to 48 hours of a vulnerability being published.

Two years earlier, on 7 November 2021, Simplify Group, described as the country’s largest conveyancer, had suffered an attack whose vector has not been published. Its accounts put the cost at around 7 million pounds, 6.8 million according to The Negotiator’s reading, with some ten weeks of reduced activity.

Snexi and the ChimeraZ wave: the property manager’s data at its inventory inspection provider (2026)

This recent case must be read with a caveat: part of it is known only through a hacker’s claims. From 9 June 2026, an actor calling itself ChimeraZ put up for sale databases it attributed to Leboncoin Immobilier, Propriétés Privées, Capifrance and then, on 24 June, to the Digit RE group, with volumes of several million rows relayed by ZATAZ from 9 June, then by specialist sites. Those volumes are the hacker’s. A confirmation of unauthorised access by Digit RE was reported by a specialist site, without any official statement having been found.

The established part concerns Snexi, a company from Tours specialising in inventory inspections and property diagnostics, part of the Arche group. Attacked on 2 September 2026, it confirmed in writing on 7 September that the published samples came from its incident; La Nouvelle République published its notice on 8 September. The data potentially compromised is, according to the company, surnames, first names, email and postal addresses and telephone numbers; Snexi states that it holds no financial, banking or sensitive data. It notified the CNIL and opened a dedicated contact address. On 11 September, the hacker claimed 2,249,970 rows, 1,139,584 individuals, 1,833 agencies and 49,899 “door codes”, of which around 90% were said to be linked to the Citya Immobilier network. That link is not confirmed and nothing indicates that Citya’s systems were compromised: the data most likely comes from the provider’s tool.

Why does this case appear here despite these reservations? Because the mechanism is the one that threatens a managing agent in Luxembourg. An inventory inspection provider needs the address, the tenant’s name, an appointment and, often, the door code. If it is compromised, the managing agent has not been attacked, but its co-owners may receive targeted emails in their manager’s name, and a code tied to a precise address may end up in strangers’ hands. A door code in a database is a key.

What this teaches a building or a co-ownership in Luxembourg

These steps are a matter of contract, procedure and governance, not of technology.

• Keep the list of providers that have access. Heating contractor, lift company, alarm installer, portal vendor, inventory inspection platform, external accountant: who accesses what, by what means, since when. The list is reviewed at every change of contract, after an acquisition or a merger, and access is withdrawn at the end of the engagement. At Target, an invoicing account served as the entry point.
• Segment. The portal where a supplier submits its invoices has no business seeing the co-ownership’s accounts, the technical supervision or the access control. The 2017 settlement imposed this on Target.
• A second factor on every remote access, and prompt patching. The joint advisory on CitrixBleed is a reminder that an unpatched remote-access gateway can allow that second factor to be bypassed; that is the hypothesis put forward, without confirmation, for CTS. Ask the IT provider who tracks the patches for Internet-facing equipment and within what time; the same advisory speaks of 24 to 48 hours. The same question applies to equipment installed in the building: who updates it, who has changed its factory credentials.
• Write security into the contract. Article 28 of the GDPR requires processors handling personal data to be bound by a contract. In its file on video surveillance in co-owned buildings, the CNPD recalls that the association of co-owners is the data controller and that the managing agent acts as a processor; the providers the managing agent brings in are framed in the same way: data received, retention period, protection, time limit and channel for alerting in the event of an incident. A code held by a compromised provider gets changed.
• A transfer procedure that does not depend on an email. At RealPage, altering disbursement instructions was all it took. For a co-ownership: four-eyes approval above a threshold, verification through an independent channel of any change to bank details, ceilings on collection accounts. And read the insurance policy before the loss: RealPage discovered after the fact that its customers’ funds, in transit with a third party, were not covered.
• Plan for continuity without the provider. CTS’s clients lost access to their files for weeks. Where are the co-ownership’s files hosted, is there a copy independent of the host, what happens if the tool stops for a month, and who bears private individuals’ costs when a deadline is missed?
• Read the alerts. Target had tools that detected the intrusion; nobody followed up. An alert that nobody reads protects no one.
• Notify quickly, through a safe channel. RealPage alerted banks and authorities immediately and was able to freeze nearly 3 million dollars. In Luxembourg, a personal data breach is notified to the CNPD within the 72 hours of Article 33 of the GDPR, and CIRCL, the national incident response centre, can be called upon. Article 34 of the GDPR requires the persons concerned to be informed without undue delay: better that co-owners hear it from their managing agent than from a fraudulent email.
• Distinguish the confirmed from the claimed. In the ChimeraZ wave, only Snexi’s statement is established; the volumes and the link with Citya are the hacker’s. Passing a rumour on to co-owners adds harm to the incident.

The common thread fits in one sentence: responsibility does not leave the party that entrusted the access or the data, even when it is the processor that lost them. A managing agent can delegate a service, not the responsibility for what happens to the co-owners.

Sources

• United States Senate, Committee on Commerce, hearing and “Kill Chain” report, 26 March 2014: govinfo.gov.
• Krebs on Security, 5 February 2014: krebsonsecurity.com; 12 February 2014: krebsonsecurity.com.
• Target, Form 8-K, SEC, 5 May 2014: sec.gov.
• Attorney General for the District of Columbia, 23 May 2017: oag.dc.gov.
• RealPage, Form 10-Q, first quarter 2018: sec.gov.
• HousingWire, 27 January 2020: housingwire.com.
• Court of Appeals for the Fifth Circuit, RealPage v. National Union, 22 December 2021: caselaw.findlaw.com.
• Federal court for the Northern District of Texas, 5 September 2024: govinfo.gov.
• The Record, 24 November 2023: therecord.media.
• TechCrunch, 27 November 2023: techcrunch.com.
• CISA, FBI, MS-ISAC and ACSC, advisory AA23-325A, 21 November 2023: cisa.gov.
• Today’s Conveyancer, 21 December 2023 (no link).
• The Negotiator, 10 May 2023: thenegotiator.co.uk.
• ZATAZ, 9 June 2026: zataz.com.
• La Nouvelle République, Tours, 8 September 2026, article by Alexandre Métivier reproducing Snexi’s notice (no link).
• CNPD, thematic file “Video surveillance in co-owned buildings”: cnpd.public.lu.