Millions of lease agreements and tenants’ personal documents have been left vulnerable online due to security flaws in platforms used by Australian real estate agents, according to a digital researcher.
The unnamed researcher analysed seven rental platforms and found that hyperlinks containing sensitive data – including identification, payslips, and references – could be accessed without login. In some cases, documents were retrievable by simply altering a number in the URL, with invitation codes ranging from one to four million.
One platform, Inspection Express, said it had upgraded security after the researcher reported the issue last year, introducing time-limited and access-restricted links. However, other companies failed to respond. Digital rights advocate Samantha Floreani described the situation as “a blatant and disturbing disregard for the law and for people’s security”.
The Office of the Australian Information Commissioner confirmed it had not received any breach notifications from the platforms, but noted that it is making the rent-tech sector a “key priority” for 2025.
