The Housing Ombudsman Service has taken its online complaints channels offline after a security incident at an outside supplier reached the system it uses to manage cases. The watchdog says the incident is contained and has been reported to the data protection regulator, but it does not yet know whether residents’ personal information was exposed.
What happened
On Tuesday 13 October 2026 the Housing Ombudsman Service, which resolves disputes between social housing residents and their landlords in England, published a statement confirming a “third-party IT security incident” affecting its case management system. The Ombudsman is a public body backed by the Ministry of Housing, Communities and Local Government (MHCLG), so this is a central government organisation dealing with a supplier compromise.
According to the statement, last updated at 11:00 that morning, the incident has been contained and the Ombudsman is working with the unnamed supplier to establish the facts, including how much data was involved. It is still checking whether residents’ personal details were touched and has reported the incident to the UK data protection regulator, which its statement calls the Information Commission (still widely known as the ICO).
While systems are restored, residents cannot submit a new complaint, view an existing one, or use the web chat and webform. New complaints can be made by email to info@housing-ombudsman.org.uk or by telephone on 0300 111 3000, and the Ombudsman has given a contact address for its Data Protection Officer.
BleepingComputer reported the incident the same day, describing the Ombudsman as working with the affected provider to assess the impact. Landlords have started telling their own tenants. Lifestone Homes posted a notice saying the incident may have affected the personal details of people who contacted the Ombudsman directly, that residents who have never done so are not affected, and that its own systems were not involved.
The detail
Very little is public about the technical side, and it is worth being clear about that. The supplier has not been named. The Ombudsman has not said whether this was ransomware, credential theft, exploitation of a vulnerable product or something else, and it has not used the phrase “cyber attack” in its own statement. No criminal group had publicly claimed the incident at the time of writing, as far as I could find.
What we do know is where the problem landed: the case management system. For an ombudsman, that is the core of the operation. It holds complaint records, correspondence between residents, landlords and caseworkers, and supporting evidence. In housing complaints that evidence often covers damp and mould, disrepair, anti-social behaviour, and the health, disability or family circumstances that explain why a problem matters. Any assessment of potential harm has to start from the fact that this kind of record is far more sensitive than a simple list of names and email addresses.
The way the service failed also tells us something. The public-facing complaint form, web chat and the ability to view existing cases all went offline together, which suggests they depend on the same supplier-hosted platform. That shows how much of a public body’s front door can sit on one third party.
Why it matters for UK organisations
This is another reminder that a public body’s data protection obligations do not move to its supplier when the data does. The Ombudsman is the controller for complaint data, so it carries the duty to assess the risk to individuals and to tell them if that risk is high, whatever happened inside the supplier’s environment. Bodies relying on software-as-a-service case management platforms should ask themselves whether they could answer the basic questions (what data, whose, how much, since when) on day one of a supplier incident.
The incident also has a knock-on effect across social housing. Hundreds of landlords and many thousands of residents interact with the Ombudsman, and the people with open complaints are often already in difficult situations. That makes them an attractive audience for follow-on fraud. A message claiming to be from the Ombudsman, a landlord or a “compensation” firm, quoting a real case reference, would be highly convincing. Scam calls of this kind tend to arrive in the days after a breach becomes public, while people are still anxious and before the facts are known.
Expert view
When we assess supplier risk for clients, case management and CRM platforms are often treated as “just software” rather than as repositories of the most sensitive data the organisation holds. The questionnaire is completed at procurement and rarely revisited. That gap is where incidents like this live.
In my experience, the most useful thing an organisation can do before a supplier incident is know exactly what the supplier holds and how to switch it off. The Ombudsman appears to have done the second part quickly: services were withdrawn, alternative channels were published and the regulator had been told by the time of the first statement. That is a reasonable first response. The harder part is the forensic picture, because the controller depends on the supplier’s logs, the supplier’s investigators and the supplier’s honesty about timelines. Contracts that do not guarantee prompt access to that evidence leave the customer waiting.
I would also urge caution about early reassurance in either direction. “Contained” means the attacker’s access has been cut, not that no data left. Equally, nothing published so far shows that data was stolen. Residents should be careful, but should not assume the worst, and organisations commenting on this should not speculate beyond what the Ombudsman and its supplier have confirmed.
What to do now
- Residents and complainants: treat unexpected calls, emails and texts about a housing complaint with suspicion, even if they quote real details. Contact the Ombudsman or your landlord through the numbers and addresses on their official websites, and never hand over bank details or passwords to an inbound caller.
- Social landlords: brief front-line and complaints staff that residents may receive convincing scam contact, publish a short notice as Lifestone Homes has, and route any data concerns to the Ombudsman’s Data Protection Officer rather than speculating.
- Any organisation using hosted case management: confirm what personal and special category data your supplier holds, check the contract for breach notification timescales and access to forensic evidence, and make sure you have an offline way to keep taking work if the platform goes down.
- Tighten supplier access: in line with Cyber Essentials user access control and secure configuration, review which supplier accounts can reach your data, enforce multi-factor authentication on them and remove dormant access.
- Rehearse the controller’s role: run a tabletop exercise where your main SaaS provider is breached, including who decides on regulator notification within 72 hours and who writes to affected individuals.
Bottom line
The Housing Ombudsman has done the visible basics: it contained the incident, withdrew affected services, offered alternative channels and told the regulator. The open questions are the important ones: who the supplier is, what happened, and whether sensitive complaint records were taken. Until those are answered, the practical risk for residents is targeted fraud, and the lesson for every other organisation is to know what its suppliers hold before a statement like this has to be written.
