Real estate agents in Australia using apps that leave millions of lease documents at risk, digital researcher says
Australian platforms used by real estate agents to upload documentation for renters and landlords are leaving people’s personal information exposed in hyperlinks accessible online,An analysis of seven rent platforms provided to Guardian Australia by a researcher, who wished to remain anonymous, revealed millions of leasing documents could be accessed by threat actors,Sign up: AU Breaking News emailReal estate agents manage sensitive tenant and landlord data on a daily basis, including lease agreements, identification documents, payslips and personal references,Online platforms enable agents to store these documents in the cloud and make them accessible via hyperlinks,The researcher found these links can be scanned by web crawlers and cached.
Guardian Australia has seen six examples of rental agreements, employer and personal references, and other documents available online.While the links were obscured through randomised characters, they did not require a log-in to view them.The researcher identified that the underlying platform used by rental companies makes it easy to access documents by simply adding or subtracting a number on the URL real estate companies send to prospective tenants.The researcher said the documents date back to 2017, with the first invite code being 1, and now reaching 4m.In another case, the researcher was able to access a lease agreement due to one platform’s use of URL shorteners, which make the URLs easier to guess.
Once the lease was accessed, the platform provided an authentication cookie, giving access to the landlord’s entire rental history, maintenance and other documents.Inspection Express, one platform that was identified as allowing access to hyperlinks without requiring authentication, said it had undertaken a review of how its documents links are accessed and shared.It said this month it had upgraded its security, after the researcher reported the issue directly to the company last year.“Inspection Express does not make customer documents publicly discoverable or indexable by Google or other search engines,” a spokesperson said.“Documents are accessed via controlled links and are not published to the open web by our platform, and our review did not identify any open web discovery.
“The enhancements include document links that automatically expire after a limited number of accesses or a defined time window, along with additional restrictions on link sharing and copying.Intended recipients can securely request a new link if required.”Another platform the researcher identified has put in an additional security measure requiring the user to enter their postcode before accessing the document.A number of platforms in the research did not respond to requests for comment, and did not respond to the researcher.Samantha Floreani, a digital rights advocate and PhD candidate analysing rental tech, said the research showed a very serious lack of care for privacy and security in the industry.
“It is appalling that months after being notified of these vulnerabilities, most companies have done nothing,” she said.“This is a blatant and disturbing disregard for the law and for people’s security.“While these companies turn a profit by inserting themselves as intermediaries between renters, agents and landlords and collecting vast quantities of data, the benefits to renters are questionable at best.”Floreani said left unchecked the companies are putting an enormous number of Australians at risk.“Renters have very little power to refuse to use these systems because saying no can lead to retaliation, a bad reference, or just missing out on a home altogether,” she said.
“To have no real choice but to use these platforms in order to access and retain housing, then to have the information you are forced to hand over left unprotected, adds insult to injury in an already deeply dehumanising system.”A spokesperson for the Office of the Australian Information Commissioner said the agency had received no notifications from the platforms regarding potential data breaches.The spokesperson said the increasing demands from rental and property companies for people to hand over their personal information to rent tech apps is a “key priority” for the OAIC this year.“It is a sector that creates power and information imbalances, and [the OAIC] is currently scrutinising rent tech platforms,” the spokesperson said.
UK hospitality firms demand more help with business rates amid questions over Heathrow discount
Struggling hotels, restaurants and nightclubs are calling for more financial help with business rates after it emerged that Heathrow is among the biggest beneficiaries of a multibillion-pound package of state support.The UK’s biggest airport is in line for a discount of nearly £900m on its rates bill over the next three years. That is a fifth of the total £4.3bn “transitional relief” fund announced by the chancellor in the budget for all businesses facing big bill increases.Heathrow’s rates bill will still rise by £50m to £171m this year, according to figures compiled by the property firm Avison Young and first reported by the Sunday Times
Employers are spreading raises like peanut butter – and workers are paying the price | Gene Marks
Looking forward to a raise in 2026? You may be getting “peanut butter”.A new report from compensation software and data provider Payscale predicts that in 2026, many employers will be giving “peanut butter raises” to their employees – increases given “across the board” as opposed to being calculated individually based on performance or merit. They’re spread evenly, like peanut butter on a slice of bread.“In total, more than 40% of organizations are either using or actively considering standardized across-the-board or peanut butter pay increases in 2026,” the report said. “This increases to 56% for top performers (organizations who reported that they would exceed their revenue goals in 2025)
‘It’s really sad’: US TikTok users rethink app over concerns about privacy and censorship
Many TikTok users across the US say they’re rethinking their relationship with the platform since its ownership and terms and conditions have recently changed, with some citing censorship and lack of trust as reasons why they’re removing themselves from the app.Keara Sullivan, a 26-year-old comedian, says TikTok jumpstarted her career and provided a pathway to getting a manager and a literary agent.“I’m not one of those creators who’s a TikTok hater,” said Sullivan, who has more than half a million followers on the platform. “I’m very transparent about the fact that where I am in my career is largely because of TikTok.”That’s why, she said, it’s “really sad” for her to step away from the platform – at least for now
Why TikTok’s first week of American ownership was a disaster
A little more than one week ago, TikTok stepped on to US shores as a naturalized citizen. Ever since, the video app has been fighting for its life.TikTok’s calamitous emigration began on 22 January when its Chinese parent company, ByteDance, finalized a deal to sell the app to a group of US investors, among them the business software giant Oracle. The app’s time under Chinese ownership had been marked by a meteoric ascent to more than a billion users, which left incumbents such as Instagram looking like the next Myspace. But TikTok’s short new life in the US has been less than auspicious
Brighterdaysahead topples favourite Lossiemouth to win Irish Champion Hurdle
There was a full-throated roar from the stands as the 2026 Dublin racing festival finally got under way on Sunday and another as Lossiemouth, the favourite, went to post for the Irish Champion Hurdle later in the afternoon, but the cheers 10 minutes later were for her market rival, Brighterdaysahead, as Gordon Elliott’s mare convincingly reversed the form of the December Hurdle here last month to win the big race of the day.Lossiemouth and Brighterdaysahead were foaled within three weeks of each other in March 2019 but last month’s Grade One was the first time that the two mares had met on the track.Lossiemouth emerged as the winner by a length, recording a ninth Grade One win in the process, but she did not look comfortable at any stage here on Sunday as El Fabiolo, a stable companion at the Willie Mullins yard, set a steady pace with Brighterdaysahead in close attendance.Paul Townend, Lossiemouth’s rider, made some ground on the turn for home as El Fabiolo dropped away, but Jack Kennedy soon pushed Brighterdaysahead into a useful lead and a good jump at the last set the seal on a three-and-a-quarter length success.The result prompted some abrupt and significant moves in the ante-post betting for next month’s Cheltenham festival, as Lossiemouth, who set off as the narrow favourite for the Champion Hurdle on 10 March, was pushed out to a top price of 7-1 and simultaneously cut to around 11-10 for the Mares’ Hurdle, a race she has won in the past two seasons, on 12 March
Tuskegee basketball coach ‘violated’ after being handcuffed by police at end of game
Tuskegee men’s basketball coach Benjy Taylor is considering legal action after being handcuffed and led off court at the end of his team’s loss to Morehouse College on Saturday.Tuskegee athletic director Reginald Ruffin said Taylor had attempted to make sure protocols were followed when opposing Morehouse football players joining the basketball players in the postgame handshake line.“You don’t do that … that’s a security breach,” Ruffin told HBCU Gameday. “We have security measures for our protection of our officials, our student athlete coaches and spectators.”Videos of the incident soon spread online
Benjamina Ebuehi’s recipe for citrus and almond cake | The sweet spot
‘It’s still a family favourite’: your heirloom recipes – and the stories behind them
Rachel Roddy’s puntarelle, radicchio, celery, apple and cheese salad recipe
How to convert kitchen scraps into an infused oil – recipe
Slurp the blues away: Ravinder Bhogal’s recipes for winter noodle soup-stews
Savoury snacks to stave off the lure of the biscuit tin | Kitchen aide