New GlobalData research finds that cyber insurance penetration among UK real estate and renting businesses remains below the wider SME market, even as property-sector cyber incidents and conveyancing fraud losses continue to rise.
21 September 2026 — UK property businesses are becoming more digitally dependent while remaining comparatively underinsured against cyber risk, according to new research from GlobalData.
The company’s Q1 2025 UK SME Insurance Survey found that cyber insurance penetration in the real estate and renting sector sits below the wider SME market across every business size. Coverage stands at 7.7% among sole traders, 15.8% among micro businesses, 20.5% among small businesses and 55% among medium-sized firms. Across the wider SME market, the equivalent figures are 13.1%, 26.4%, 40.1% and 63%.
The gap is becoming more significant as cyber exposure increases. Figures sourced from the Information Commissioner’s Office show that cyberattacks against UK property services businesses rose from 178 incidents in 2024 to 208 in 2025, an increase of around 17%.
Property companies hold particularly valuable data
Estate agents, property managers, landlords and other real estate businesses routinely process highly sensitive information. This can include bank details, mortgage records, tenancy documentation, proof of address, passports and driving licences used for identity and anti-money-laundering checks.
That combination makes the sector attractive to cybercriminals.
A breach can expose customer data, but the consequences can extend much further. Stolen credentials may be used for identity fraud, ransomware, account compromise or payment diversion, while businesses themselves may face interruption, recovery costs and reputational damage.
Charlie Hutcherson, Senior Insurance Analyst at GlobalData, said property businesses are becoming increasingly reliant on digital systems while continuing to hold large volumes of sensitive personal and financial information.
The result is a risk profile that now extends beyond conventional data protection and into operational resilience.
Conveyancing fraud has already cost millions
One of the clearest examples is conveyancing fraud, where criminals impersonate solicitors, estate agents or other trusted parties and redirect property payments to accounts they control.
City of London Police and Action Fraud recorded 143 cases between 1 April 2024 and 31 March 2025, resulting in losses of £11.7 million. Of those, 140 involved residential property transactions, accounting for £10.97 million in losses. The average residential loss reached £78,393 per case.
Commercial property cases were far less common, with three incidents recorded, but losses totalled £773,500, equivalent to an average of roughly £257,833 per case.
The fraud typically involves attackers gaining access to communications around a transaction and sending altered payment instructions at the point when large sums are expected to move. This makes the property sector particularly vulnerable because transactions often involve multiple organisations and individuals exchanging sensitive information over email.
Smaller businesses remain the most exposed
GlobalData’s figures show that cyber insurance penetration rises sharply with company size.
More than half of medium-sized property businesses have cover, but among sole traders penetration falls below 8%. Small firms also show a substantial gap compared with the broader SME market, with only 20.5% covered versus 40.1% across SMEs overall.
That matters because smaller firms may have fewer internal cybersecurity resources and less capacity to absorb the financial impact of an incident.
A larger property group may have dedicated IT teams, security software, incident-response processes and professional advisers. A small estate agency or independent property business may instead rely on outsourced technology and general business systems while handling much of the same sensitive customer information.
GlobalData’s wider SME research has also found that some businesses remain uninsured because they do not expect to become targets. In its 2025 UK SME Insurance Survey, 40.5% of SMEs without cyber insurance said they considered an attack unlikely, while 16.4% believed their existing security measures provided sufficient protection.
Cybersecurity and cyber insurance are not substitutes
The insurance gap also highlights an important distinction between prevention and financial protection.
Cybersecurity controls can reduce risk, but they cannot guarantee that an organisation will avoid every incident. Phishing, compromised suppliers, stolen credentials and human error can still lead to breaches even where security tools are in place.
Cyber insurance, meanwhile, does not replace those controls.
Instead, it can form one layer of a wider risk-management strategy covering areas such as incident response, business interruption, recovery and liability, depending on the policy.
For property companies, this layered approach is increasingly relevant because digital systems now support everything from customer onboarding and tenancy management to payments, document exchange and transaction coordination.
Insurers see an underserved SME market
The low penetration rates also create a commercial opportunity for the insurance sector.
GlobalData’s separate 2025 UK Commercial Insurance Broker Survey found that 53.6% of brokers identified cyber insurance as the emerging commercial insurance product with the greatest growth potential.
Hutcherson argues that insurers need to do more than raise awareness. Products also need to become easier for smaller businesses to understand and access.
That is particularly important in sectors such as property, where firms may recognise cyber risk in general terms but not fully understand how a serious incident could affect revenue, transaction completion or customer trust.
The challenge for brokers and insurers is therefore partly educational: translating technical cyber threats into concrete business scenarios that owners and managers can evaluate.
Property digitisation is increasing the attack surface
The underlying exposure is unlikely to disappear.
Property transactions and customer relationships are increasingly digital, with businesses depending on cloud platforms, electronic document exchange, remote identification, online payments and digital property-management systems.
Each additional system creates efficiency, but it can also introduce another potential point of compromise.
This changes the risk profile of property businesses. Cybersecurity is no longer only an IT issue; it increasingly affects finance, compliance, customer service and business continuity.
For smaller firms in particular, the growth of digital property services means cyber resilience may need to be treated as a core operational requirement alongside professional indemnity, financial controls and data protection.
Cyber resilience is becoming a business issue
The latest data point to a widening gap between how property companies operate and how they insure themselves.
Cyberattacks against the sector increased during 2025, while highly sensitive data and large financial transactions continue to attract criminals. Yet insurance uptake among smaller property businesses remains well below the wider SME average.
As digitisation deepens across the property market, firms will need to consider not only how they prevent attacks but also how they recover when incidents occur.
For insurers, brokers and technology providers, that creates a growing market around prevention, response and financial protection.
For property businesses, it creates a more immediate question: whether their existing cybersecurity and insurance arrangements are keeping pace with how much of their operation now depends on digital systems.
About GlobalData
GlobalData Plc (LSE: DATA) provides intelligence and analytics across multiple industries by combining proprietary data, human expertise and purpose-built AI. The company says its platform is used by more than 5,000 organisations worldwide for strategic planning, innovation, risk management and growth.
