Your co-op or condo unit houses more than your material possessions. The management office also typically contains detailed information about you—including your social security number, credit card number, emergency information, phone number and many other important documents relevant to your security.

And that information is worth a lot of money to hackers—or anyone interested in using the content of your private files to their advantage.

Locking it Down

With more and more information and day-to-day business functions being handled online, the safety and security of users' personal data and privacy has become a major concern for everyone—and that includes property managers and board members.

And while identity theft is a growing business, New Jersey has enacted laws to make sure your information doesn’t leave the management company’s computers or offices. In September 2005, then New Jersey Governor Richard J. Codey signed a package of identity theft safeguards into law which provides state residents some of the toughest protections in the U.S. against such fraud—and imposes strict penalties on any company that doesn’t protect the social security numbers that they’re responsible for safeguarding.

Laws that provide identity theft safeguards were enacted to protect you, and they’re applied to all non-governmental bodies—including individuals, corporations, and partnerships. Before you hire a management company for your co-op or condo, you should figure out a plan of action to protect your building’s personal information, and make sure you know the 411 on how and why this information can be stolen.

But legislation alone hasn’t completely wiped out identity theft. “It’s my understanding that there are people who still sell Social Security numbers, credit card numbers and other personal information that they hack off the computer,” says Stephen Elbaz, president of Esquire Management Corporation, a management company based in Brooklyn, that also manages properties in New Jersey. “They can buy those numbers for 50 cents each, and the online theft of personal information is causing bank losses in the billions per year.”

In 2008, a whopping 134 million credit card numbers were stolen via Heartland Payment Systems, when hackers injected spyware onto their data systems to monitor their credit card transactions.

Just as recently as March 2011, 40 million employee records were stolen from RSA Security when an e-mail containing malware was sent to some employees. It installed a remote tool that gave the hacker access to the security company’s computers, and they got access to all the data.

And in April 2011, 77 million PlayStation Network accounts were hacked, giving unprecedented access to unencrypted credit card numbers, full names, passwords, addresses, e-mails and purchase history.

“It’s a huge problem,” says John O’Keefe, CEO of ITelagen, an information technology and security company based in Jersey City that helps management companies, buildings and other large corporations protect their data. “Back in 2002, before I started this company, I was CEO of a software company. Our internal Web site was hacked, and they put up a terrorism page. It was eye opening for me and the company back then.”

Protecting the Personal

While O’Keefe’s website was hacked due to anti-American sentiment, there could a huge range of reasons why people attack company’s computers, O’Keefe says.

Sometimes, it’s to get access to social security numbers, credit card numbers and other personal information. But more than 50 percent of the hackers are from China, the Middle East and other areas around the world, he says, and they use smaller company’s computer systems as platforms to hack into bigger companies.

“A lot of times, they’re just trying to bring systems down,” O’Keefe says.

The big issue for property management companies and co-op and condo boards is to simply keep everyone’s information safe. But sometimes, it’s harder than it sounds. It requires passwords, locked safes and other measures to keep the rest of the world out.

Elbaz says his property management firm has password protected computers to make it as difficult as possible for hackers to get in. In addition, all of their physical files are kept in locked cabinets, and only a few people have access to it.

“Not only does this prevent hackers and crooks, but it also prevents any person in the management company from getting the information as well,” says Elbaz, who isn’t willing to take any risks, even amongst his own employees.

He tries to limit the number of people who know the passwords and who have the keys to the physical material. For example, the only person who has access to the payroll records, complete with social security numbers and addresses, is the human resources person, Elbaz says.

Other building management companies try to protect themselves by refusing to hold onto any important information.

Martin Laderman, CEO of MEM Property Management Corporation in Jersey City, takes security one step further. He says he doesn’t store any of the owner’s social security numbers in his office or even on his computer. He passes it all over to the banks, and makes sure that no trace of it is left with his company.

“The only thing we have is the unit owner’s license plate numbers, copies of the leases and emergency contact numbers,” Laderman says. He keeps that information on the computers, which are protected by multiple firewalls.

For the vendor’s information, Laderman says, he only keeps tax ID numbers, and the only people who can access those numbers is one account head and himself. When owners have to register their cars with the building so they can park in the garage, he asks for a copy of their driver’s licenses but he tells the owners that they can scratch out their driver’s license number.

“We just need proof that they live there,” he says. “If we take a phone bill from them, they can block out all their private information. We just need the bill to prove that they live there.”

Switching Safely

Sometimes, however, a property management company needs to transfer all of the owner’s information between offices when a building switches to a new management company. Getting the information to the new office without an outside hacker tapping into the private info is key.

Elbaz says he safeguards the information by waiting for the new management firm to physically pick up the boxes of records instead of shipping them.

Since Laderman stores the direct debit and other information with the bank, he leaves it up to the bank to do the transferring if they need to switch banks at all. The rest of the information, such as the blocked out phone bills, are useless to outsiders, he says.

Once the information gets to the new company—or even if it’s staying with the old management firm, it’s important to get qualified people to safeguard it, Laderman says. His company uses a professional information technology firm to protect his company. “It’s not cheap, but it’s the cost of doing business, like a telephone,” he says. “That’s our infrastructure, so we don’t play games with that.”

He uses ITelegen, which offers different protection packages, depending on the size of the company and their needs. Laderman says he uses ITelegen to set up multiple firewalls, and to monitor the infrastructure 24 hours a day, seven days a week. He also has on-site backups and off-site backups in case of a fire or other tragedy.

ITelagen’s O’Keefe says that a basic security device for a small company doesn’t have to be expensive. The first thing he does when he’s hired by a management firm or other company is to set up basic security to protect them, such as a strong firewall. Basic firewalls to protect their computers from hackers and other issues, cost between $400 to $500, he says.

Sometimes, however, regardless of the best security systems and the best information technology teams, private information does get stolen.

At that point, there are a few things that could happen.

This summer, the Dutch government was hacked despite being guarded by DigiNotar, a U.S.-owned, Netherlands-based a company providing digital security. The Dutch government had to shut down its computers and temporarily return to using paper documents and fax machines.

In June, hackers managed to get access to 1.5 percent of 24 million American credit-card accounts, which led to about $2.7 million in losses for 3,400 people.

At that point, says Elbaz, it’s time to “Sue, sue, sue.”

And while suing has become a standard rule of thumb these days, Laderman says it’s easier to simply refuse any information so you can’t be held responsible.

“We know that accidents happen,” he says. “That’s why we don’t ask for that information, and we don’t want it. It doesn’t even come into play. We do have a concern about privacy, and you don’t want your neighbors to know about your information either. Even if a buyer calls, and asks what’s due for the sellers, we don’t give out that information. All the information that we have will go directly to the unit owner. And we don’t e-mail it to them either—you have to be careful about e-mailing.”

Danielle Braff is a freelance writer and a frequent contributor to The New Jersey Cooperator. Associate Editor Liam P. Cusack contributed to this article.