A four-agent brokerage in Toronto opens Outlook on the morning of a closing. Every email since last night returns an error. A note pinned to the accounts folder demands 12 bitcoin, payable within 72 hours, or the transaction files land on a public leak site. The senior broker calls the Real Estate Council of Ontario before calling the RCMP. The clients whose closing is scheduled for that afternoon do not know yet that they will never see their down-payment funds again.
What the brokerage does not know that morning: the attackers have been inside for 47 days.
During those 47 days the attackers read six active purchase-and-sale agreements (each with buyer identities, deposit amounts, closing dates, and lawyer contact information); the escrow-trust account routing details for the firm's trust ledger; wire-transfer instruction templates the office administrator uses to send closing funds; and the internal correspondence chain between the brokerage, the buyers, the sellers, and their lawyers on every active deal. All of that material was copied to an attacker-controlled server before the ransomware payload deployed. The ransomware is not the actual attack. The actual attack is the closing wire that arrives at the buyer's inbox the morning of the deal, apparently from the brokerage, apparently signed by the correct broker, with instructions to route the funds to a "new trust account."
The transaction files were worst. Each purchase-and-sale contained the buyer's full identity, the deposit already in trust, the closing date to the hour, and the exact language the broker had been using on the file for weeks. In every documented small-brokerage BEC leak of the past three years, the closing files were the material attackers monetized first — because the closing wire misdirect is the highest-yield payload an attacker can extract from a professional-services firm. A single misdirected closing routinely runs six figures. Some hit seven.
The industry response to small-firm ransomware has settled on two controls: multi-factor authentication on email accounts, and daily encrypted backups of the file server. Both are reasonable. Neither addresses the fact that in the operation described above, the confidentiality breach and the wire-fraud opportunity happened on day one of the 47-day window, not day 47.
Why "MFA and backups" misses this
Backups protect availability. The brokerage can restore the file server and the mail store from backup. The client's wired funds are already in an attacker-controlled account halfway through a cryptocurrency exchange chain and cannot be reversed. Restoring from backup does not un-send the closing wire.
Multi-factor authentication protects the sign-in event. In FBI-reported business email compromise cases where investigators reconstructed the initial intrusion, over 80 percent of victims had multi-factor authentication enabled at the time of compromise. Adversary-in-the-middle phishing pages, sold as commercial kits, capture the session cookie after multi-factor authentication passes. The attacker holds the session for the length of the session lifetime, which on default Microsoft 365 or Google Workspace configurations runs into weeks.
The provincial real-estate council disclosure obligation triggers on the confidentiality breach, not on the ransomware deployment. Whether the brokerage pays the ransom or restores from backup, the disclosure duty to affected clients and to the regulator is the same. Where the breach involves personal data covered by PIPEDA, the breach-notification duty attaches on top. The reputational and regulatory outcome is set at the moment the attacker reads the first purchase-and-sale agreement.
The actionable question is not "how do we recover after the wire lands in the wrong account?" The actionable question is: how did the attacker get 47 days of resident access to the deal file?
The 47-day reconnaissance chain
Attackers do not choose target brokerages at random. The pattern below is documented across FBI IC3 real-estate BEC advisory data, ransomware advisory reports from the Canadian Centre for Cyber Security, and disclosed incidents at title-services companies including Fidelity National Financial (SEC 8-K disclosure November 2023, ~1300 disrupted closings during a two-week outage). The pattern has recurred at small and mid-size brokerages every subsequent quarter.
Step one: identity mapping from public records
Real-estate brokerages are among the most exhaustively documented professional-services businesses in Canadian public data. Provincial real-estate council registries publish every licensed agent's name, licence date, brokerage affiliation, and market territory. MLS listings expose active inventory, listing agent, and (with a small amount of correlation) buyer's-agent information. Corporate registries expose the firm's principals and address. Firm websites publish agent biographies, direct dial numbers, and email addresses. LinkedIn shows the full staff roster. Aggregated across these sources, an attacker can construct a complete map of the brokerage's operations, active deals, and communication patterns before any technical activity begins.
Step two: breach-database credential correlation
With names and email addresses identified, attackers query breach databases for credential exposures matching those addresses. The current password is rarely the goal. Historical passwords across a decade of consumer data breaches produce patterns. An agent who used a variant of the same password on a professional network in 2016, on an MLS-integration tool in 2019, and on a file-hosting service in 2012 is telegraphing exactly how they construct passwords in 2026. Most brokerage staff email accounts are protected by passwords that a determined attacker can guess inside a small number of attempts once the historical pattern is known.
Step three: adversary-in-the-middle multi-factor authentication bypass
The industry has moved to multi-factor authentication on business email. This does not stop the reconnaissance. Adversary-in-the-middle phishing pages proxy the real sign-in flow. The user completes the multi-factor authentication challenge. The attacker captures the resulting session cookie. From that point forward the attacker holds an authenticated session for as long as the tenant's session lifetime allows, and the sign-in event looks normal in the audit log because it was a real sign-in that the real user completed.
Step four: persistence + closing-day patterning
Once inside, the attacker does not sit visibly logged in. They create inbox rules that auto-forward specific message threads (anything with "closing", "wire", "trust", "deposit", or an active buyer's name) to an external address. They study the brokerage's outgoing communication style: signature block, salutation pattern, when the broker follows up, what phrases they use to confirm wire instructions. By week three, the attacker can write a message from the broker that reads exactly like the broker wrote it.
Step five: the misdirect email
On closing day, the attacker sends a message from the compromised broker account (or a look-alike domain) to the buyer's lawyer with updated wire instructions. "For security reasons the trust account has changed. Please route today's closing funds to the following account." The receiving lawyer verifies against the broker's known email (which is the compromised broker's email). No red flags fire. The wire goes to the attacker's account. By the time the real broker discovers the mismatch, the funds have been split across three cryptocurrency exchanges.
Step six: the ransomware (optional)
In some cases, the attacker deploys ransomware after the wire lands successfully — as cover, to distract the brokerage while the funds move. In other cases, the attacker simply leaves the tenant clean and moves to the next brokerage. The wire fraud is the profit centre. Ransomware is optional.
What every small brokerage's external surface reveals
The reconnaissance chain relies on data the brokerage already publishes, plus data that leaked in incidents outside its control. Neither is fixable through backup improvements. Both are addressable through configuration.
Across the professional-services landscape LeakTrace analyses, three exposures show up on almost every small brokerage's external surface, and each one shortens the attacker's path by weeks.
Missing or misconfigured email authentication
DMARC, SPF, and DKIM are the three DNS records that determine whether an inbound mail server will accept a message claiming to be from the brokerage's domain. On most small-brokerage domains, at least one of these records is missing, weakly configured, or set to a permissive mode that does not enforce rejection. When email authentication is not enforced, an attacker impersonating the brokerage can send closing-wire instructions to the buyer's lawyer from a spoofed brokerage address — and the receiving mail server has no information to reject.
Look-alike domain registrations
Attackers pre-register typosquat and homoglyph domains of a target brokerage (yourbrokerage-ca.com instead of yourbrokerage.ca; capital-i in place of lowercase-L; .co in place of .com). These sit dormant until an active deal presents. On the day of closing, the attacker sends the wire-instruction email from the look-alike domain. Recipients whose inbox displays the sender name without hovering the address routinely miss it.
Weak conditional access on business email
Default Microsoft 365 and Google Workspace configurations grant session lifetimes measured in weeks, allow sign-ins from any country, and do not require re-authentication when the client fingerprint changes. Every one of those defaults is configurable. Almost none of them are configured on typical small-brokerage tenants.
None of these exposures require a breach to fix. Each one is a configuration decision.
What actually stops the 47-day compromise
The controls that break the reconnaissance chain sit in the window before the closing-day wire, not the hours after it.
Enforce DMARC at reject. Rotate DKIM keys on a fixed schedule. Publish MTA-STS so mail servers accepting messages from the brokerage's domain use encrypted transport. Register the top-10 most likely typosquat variants of the brokerage's domain defensively so an attacker cannot pre-position them. These changes take a knowledgeable IT contact under three hours and cost less than the CMA fee on a mid-market listing.
Configure conditional access on business email to reject sign-ins from countries the brokerage does not operate in. Set session lifetime to a value measured in hours, not weeks. Require re-authentication when the sign-in fingerprint changes. Enrol every mailbox in phishing-resistant multi-factor authentication, not SMS.
Audit every mailbox in the tenant for user-defined rules that forward externally, move messages on closing- or wire-related keywords, or hide replies from specific senders. This is the single highest-yield check for detecting an in-progress compromise. In every documented business email compromise case, the attacker created one of these rules to maintain persistence. Reviewing the ruleset takes a mail administrator about an hour per tenant.
Enforce a policy that every wire-instruction change must be verified by voice callback to a previously-known phone number for the counterparty. This single control breaks the misdirect chain even when the technical controls miss.
Continuously monitor senior broker personal data across the North American data broker landscape and submit removal requests through each site's opt-out flow. This is a subscription operation. Attempted once and abandoned, it decays inside sixty days.
Why this matters now
The provincial real-estate council disclosure obligation on a small brokerage does not care whether the encryption payload deployed successfully or the wire was recovered. It cares that a confidentiality breach happened, and it cares that a client's funds were misdirected. Where the compromised file contains personal information covered by PIPEDA, breach-notification duty attaches on top. In the operation described at the top of this briefing, both duties attached on day one of the 47-day window. Everything after that was the attacker deciding when to route the closing wire to the wrong account.
Small brokerages that want to actually reduce exposure have to intervene at the reconnaissance stage. That means treating the external attack surface, the credential exposure landscape, the look-alike domain footprint, and the tenant's own persistence-mechanism surface as continuously monitored surfaces. It also means auditing mailboxes on a schedule that reflects the attacker's operational tempo, not the brokerage's calendar.
The exposure is already indexed. The question is whether the brokerage has mapped its own footprint before the attacker did.