More than $275 million was lost to real estate wire fraud in 2025, from at least 12,368 victims, according to the FBI's 2025 Internet Crime Report, up sharply from $173 million in 2024. Real estate transactions concentrate exactly the kind of personal and financial data that makes both fraud and data breaches so costly in this sector, which is also why the industry's websites carry real compliance stakes beyond the transaction itself.
Below is how real estate fraud losses have moved since 2022, how exposed the sector's data actually is, and what that means for what a real estate agent or brokerage website needs to disclose.
How much is lost to real estate wire fraud each year?
Real estate wire fraud losses reached $275 million-plus in 2025 from at least 12,368 victims, according to the FBI's 2025 Internet Crime Report, released April 7, 2026. That is up from $173 million in 2024 (9,359 complaints) and $145 million in 2023 (9,521 complaints), though still below 2022's peak of $397 million (11,727 complaints). Much of this fraud is tied to business email compromise, which frequently targets home closings and wire transfers and ranked second among all cybercrime categories in total 2025 losses at $3.04 billion. The FBI's recovery team had more success in 2025 than in prior years, freezing $679 million of $1.16 billion in attempted thefts across 3,900 initiated recovery actions, a 58% success rate.
Figure 1: Real estate fraud losses reported to the FBI's Internet Crime Complaint Center, 2022 to 2025. Source: FBI, 2025 Internet Crime Report.
That fraud runs almost entirely through impersonation and compromised email accounts rather than a website vulnerability directly, but the personal and financial data attackers rely on, closing dates, buyer names, wiring instructions, is often the same data a real estate site's own contact forms and client portals collect and store.
Why is real estate such a target for ransomware and data breaches?
Real estate ranked as the second most ransomware-targeted industry globally in 2024, suffering 553 attacks behind only manufacturing's 660 and ahead of professional services' 487, according to Group-IB data cited in Bright Defense's 2026 ransomware statistics report. The sector's own data has also been exposed at a scale few industries can match: a cybersecurity researcher discovered an unsecured, non-password-protected database belonging to Real Estate Wealth Network in December 2023, containing 1,523,776,691 records, more than 1.5 billion, spanning property ownership, foreclosure, tax lien, and inheritance data on millions of people, including celebrities and public figures.
Figure 2: Industries most targeted by ransomware, 2024. Source: Group-IB data, cited in Bright Defense's 2026 ransomware statistics report.
Figure 3: Real estate data exposure and regulatory milestones, 2023 to 2026. Source: security press coverage of the Real Estate Wealth Network breach; FBI 2025 Internet Crime Report; California Privacy Protection Agency; National Association of Realtors.
That combination, a records-rich industry with a growing fraud target on its back, is exactly why a real estate site's privacy policy needs to name every third party a lead, a closing document, or an MLS record actually flows through, not just describe data collection in the abstract.
How many real estate agent websites have a privacy policy?
No study has audited real estate agent or brokerage websites specifically for privacy policy presence. The closest available benchmark is Pennsylvania State University's 2023 "Privacy Lost and Found" study, which crawled a dataset built from more than 7.17 million companies and found that only 34% of company websites carried a discoverable privacy policy hyperlink, with 66% carrying none at all. That gap sits against a large and slightly shrinking population of individual practitioners: NAR membership stood at 1,438,569 as of mid-June 2026, down from 1,463,352 a year earlier, and the large majority of those members run or share a personal or brokerage-branded website that collects buyer and seller contact information directly.
Figure 4: Company websites with a discoverable privacy policy, general web sample. Source: Pennsylvania State University, 2023 "Privacy Lost and Found" study.
Applying that general benchmark to an industry running well over a million individual agent sites suggests a substantial share are collecting lead-capture and mortgage-calculator data without disclosing it, a gap covered in more detail alongside a similar small-operator pattern in 72.9 Million Freelancers: The 2026 Privacy Notice Gap.
Does CCPA or GDPR apply to a real estate agent's website?
CCPA applies to a business only once it crosses one of three thresholds: $26,625,000 or more in annual gross revenue, buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually, or deriving 50% or more of revenue from selling personal information, according to the California Privacy Protection Agency. Most individual agents fall under all three thresholds and are not directly covered, though the larger brokerages and franchise networks many agents operate under often are. GDPR carries no such exemption: any agent processing an EU resident's personal data, even a single overseas buyer inquiry, is in scope regardless of transaction volume.
Figure 5: Does CCPA apply to a real estate agent or brokerage website? Source: California Privacy Protection Agency FAQ.
A brokerage that meets any one threshold needs a privacy policy covering every category of data its agent network collects, since CCPA coverage typically applies at the brokerage level even when individual agent sites sit under separate domains.
What does an MLS or IDX feed mean for a real estate site's privacy policy?
A real estate website usually runs two very different kinds of data at once: information about site visitors, and property or seller data licensed from a Multiple Listing Service and displayed through an Internet Data Exchange feed. IDX terms restrict how that licensed listing data can be redistributed and require honoring a seller's opt-out of public internet display, a compliance obligation that sits alongside, not instead of, a standard visitor privacy policy. A generic privacy policy template built for an e-commerce site rarely addresses IDX licensing terms or a mortgage calculator's third-party data flow by name; a fuller walkthrough of how to write each disclosure is covered separately in How to Write a Privacy Policy for a Real Estate Website.
Real estate website data exposure at a glance
| Metric | Figure | Year | Source |
|---|---|---|---|
| Wire fraud losses | $275 million-plus | 2025 | FBI IC3 |
| Ransomware attacks, real estate sector | 553 | 2024 | Group-IB |
| Records exposed, Real Estate Wealth Network | 1,523,776,691 | 2023 | Security press coverage |
| NAR membership | 1,438,569 | 2026 | National Association of Realtors |
The Bottom Line
Real estate sits at the intersection of high-value fraud targeting, a top-two ransomware target ranking, and a records-rich industry that has already produced one of the largest data exposures on record, yet the same general web research that applies to small businesses broadly suggests most of the sector's agent and brokerage websites still lack a proper privacy policy. An individual agent's site usually falls under CCPA's exemption threshold, but the brokerage or franchise network behind it frequently does not, and GDPR's lack of any size exemption means a single overseas inquiry can trigger obligations regardless of transaction volume. Any agent or brokerage collecting lead, closing, or MLS-adjacent data should generate a privacy policy that names every third party that data actually reaches. For how this same small-operator compliance gap plays out industry-wide, see 64% of Small Firms Document Privacy Policies: 2026 Data, and for a comparable operator-heavy sector facing its own legal-page gap, see 81% of Restaurants Have a Website: 2026 Legal Page Data.
Frequently Asked Questions
How much money was lost to real estate wire fraud in 2025? More than $275 million was stolen through real estate-related fraud from at least 12,368 victims in 2025, according to the FBI's 2025 Internet Crime Report, up from $173 million in 2024 and $145 million in 2023, though still below 2022's peak of $397 million.
Is real estate a common target for ransomware attacks? Yes. Real estate businesses suffered 553 ransomware attacks in 2024, the second most of any industry after manufacturing's 660, according to Group-IB data cited in Bright Defense's 2026 ransomware statistics report.
Does CCPA apply to a real estate agent's website? Usually not for an individual agent. CCPA applies to businesses with at least $26,625,000 in annual gross revenue, or that buy, sell, or share the personal information of 100,000 or more California consumers or households a year, or that derive 50% or more of revenue from selling personal information, per the California Privacy Protection Agency. Most solo agents fall under all three thresholds, though larger brokerages and franchises often do not.
What happened in the Real Estate Wealth Network data breach? A cybersecurity researcher discovered an unsecured, non-password-protected database belonging to Real Estate Wealth Network in December 2023, exposing 1,523,776,691 records, more than 1.5 billion, including property ownership data on millions of people, among them celebrities and public figures.
Where the Numbers Come From
- Federal Bureau of Investigation. (2026, April 7). "2025 Internet Crime Report." Real estate fraud losses and victim counts, 2022 to 2025.
- Bright Defense. (2026, April). "500+ Ransomware Statistics for 2026." Ransomware attacks by industry, 2024, citing Group-IB data.
- Security Info Watch. (2023, December). "1.5 billion records leaked in Real Estate Wealth Network data breach." Coverage of researcher Jeremiah Fowler's discovery.
- National Association of Realtors. (2026). "NAR Leaders Share Strategic Plan Momentum, Membership Count Above Budget Forecast." Membership figure, mid-June 2026.
- California Privacy Protection Agency. "Frequently Asked Questions." CCPA applicability thresholds, effective January 1, 2025.
- Pennsylvania State University. (2023, October 25). "Most websites do not publish privacy policies, researchers say." Press coverage of the DocEng '23 "Privacy Lost and Found" study.
Note: All figures verified as of September 2026. The Real Estate Wealth Network breach dates to December 2023 and is presented as a historical exposure event rather than a current one; no study directly measures privacy policy adoption among real estate agent or brokerage websites, so this post uses Pennsylvania State University's general web study as the closest available proxy. This post's figures are refreshed at least twice a year.
