An Orlando Property Manager's Data Breach Hits 13 States

The Letter Nobody Wants to Get From Their HOA

On October 5, an Orlando company that manages residential communities started notifying state regulators about a data breach. Not a lost laptop. Not a password reset. The kind of breach where Social Security numbers, bank account details, and health information may have walked out the door.

The company is a community association management firm based here in Orlando. If you own rental property, sit on an HOA board, or run any Central Florida business that keeps client records, this one is worth ten minutes of your attention. Not because of what the company did wrong. We don’t know that yet. It’s worth your attention because of what the aftermath looks like, and what it costs.

What the Filings Actually Say

The company reported the breach to the Massachusetts Office of Consumer Affairs and the Vermont Attorney General on October 5, with disclosures to attorneys general in 13 states plus federal health and securities regulators. Vermont’s official security breach registry confirms the October 5 filing and categorizes the exposed data as health information.

Per the disclosures, the exposed records included Social Security numbers, driver’s license numbers, financial account information, and health information. Names, dates of birth, and addresses are in the mix too.

Here’s what the notice did not include: how the breach happened, when it happened, how it was discovered, or how many people are affected. All of that is still blank.

That silence matters. When a company can’t yet say what happened, it has to assume the worst for everyone whose data it holds, and so does everyone waiting on answers.

Why a Property Manager Has Your Whole Life on File

Community association managers are a strange case in the data world. They look like small, local businesses. They hold data like a bank crossed with a medical office.

Think about what flows through one: ACH and bank details for dues collection. Social Security numbers from tenant screening and background checks. Driver’s licenses from gate access and leasing files. And health information, often from disability accommodation requests, emergency contact forms, or aging-in-place programs. That last category is likely why federal health regulators appear in the filing list.

One company, one incident, and suddenly homeowners in thirteen states are checking their credit reports. Vermont’s registry shows just two affected residents in that state. Two people, and the company still owes Vermont a regulatory filing. Multiply that across every state where even one resident, former tenant, or board member lives, and you start to see the shape of the problem.

This is not new territory for Central Florida, either. Back in 2022, another Orlando-area community management operation filed its own breach notice after finding an intruder on its network. Property managers keep getting hit because the data is rich and the defenses usually aren’t.

The Aftermath Is Where the Money Goes

Set aside the breach itself for a second and just add up the cleanup.

The company is offering affected people 24 months of credit monitoring through a TransUnion service, with a staffed call center and a 90 day enrollment window. Someone is paying for all of that, per person, for two years.

Then the lawyers. Plaintiffs’ firms announced investigations and began soliciting claimants within days of the first filing. That’s normal now. Class action firms watch the same state registries this article cites, and they move fast.

Then the quiet costs. Board members asking hard questions at the next meeting. Communities deciding whether to renew the management contract. Staff fielding angry calls instead of doing their jobs. None of that shows up on an invoice, and all of it is real.

A breach at a 30 person firm doesn’t cost 30 person money. It costs money scaled to every record the company ever kept.

Four Questions Worth Answering Before It’s Your Letterhead

You don’t need a security degree to get ahead of this. You need honest answers to four questions.

What personal data do we actually hold? Most owners guess low. Old leasing files, archived screening reports, and spreadsheets from 2019 all count.

Where does it live? One server? Three cloud apps? A former employee’s laptop? If the answer is “not sure,” that’s the finding.

Who can touch it? Every login that can reach resident records is a door. Vendors and portal integrations are doors too.

What happens in the first 48 hours if something goes wrong? The companies that come out of a breach intact are the ones that had a plan before they needed one, with cybersecurity monitoring in place and someone specific to call.

If you manage communities or multifamily portfolios, this is exactly the gap our multifamily IT services team works on, and the same logic applies across the industries we support.

And if you have an IT provider right now who has never walked you through those four questions, never inventoried your data, never rehearsed an incident with you, that tells you something about the relationship. Plenty of Orlando businesses stay with an IT company out of inertia, not confidence. If that’s you, it’s worth reading how switching IT providers actually works. It’s calmer than you think, and waiting for a breach to force the decision is the expensive version.

For Central Florida Businesses Watching This One

Cyber Command is based in Winter Springs and provides managed IT support for Orlando, Tampa Bay, and Jacksonville businesses, with real humans answering 24/7. No phone trees, no ticket black holes. If this story made you wonder what your own exposure looks like, we’ll walk through those four questions with you, no charge and no pitch. Call (407) 587-0089 or reach out here.

Stop waiting for IT support. Talk to a real expert.

#CyberSecurity #ManagedIT #PropertyManagement #DataBreach #Orlando #CentralFlorida