Millions of leasing documents from Australian rental platforms are accessible online via hyperlinks that do not require authentication, a digital researcher has found. The analysis of seven platforms, seen exclusively by Guardian Australia, revealed that lease agreements, identification documents, payslips and personal references could be accessed by threat actors.
The researcher, who wished to remain anonymous, found that links sent to tenants and landlords can be scanned by web crawlers and cached. In some cases, documents could be accessed by simply adding or subtracting a number on the URL. Another platform’s use of URL shorteners made the links easier to guess.
Guardian Australia viewed six examples of rental agreements, employer references and other documents online. The documents date back to 2017, with one platform’s invite codes starting at 1 and now reaching 4 million. In one instance, accessing a lease via a shortened URL gave an authentication cookie that exposed the landlord’s entire rental history and maintenance records.
Inspection Express, one of the platforms identified, said it had upgraded security after the researcher reported the issue last year. “Documents are accessed via controlled links and are not published to the open web,” a spokesperson said. The enhancements include automatic link expiry after a limited number of accesses or a defined time window. Another platform has added a postcode requirement before document access.
Samantha Floreani, a digital rights advocate and PhD candidate, said the research showed a serious lack of care for privacy. “It is appalling that months after being notified, most companies have done nothing,” she said. “Renters have little power to refuse to use these systems, and to have their information left unprotected adds insult to injury.”
A spokesperson for the Office of the Australian Information Commissioner said the agency had received no notifications from the platforms regarding data breaches. The rental tech sector, they added, is a “key priority” this year due to “power and information imbalances”.
