Housing Ombudsman Service investigates IT security breach affecting data

Housing Ombudsman Service investigates IT security breach affecting data

The Housing Ombudsman Service has disclosed an IT security incident involving unauthorised access to its case management system. The breach, linked to a third-party supplier, is under investigation with the system currently offline to mitigate further risk.

The incident, reported to the Information Commissioner’s Office, may have compromised personal data held by the service. Landlords, agents and tenants involved in disputes handled by the Ombudsman should be alert to potential phishing or fraudulent communications.

The Housing Ombudsman Service is working with external experts and its supplier to determine the scope of the breach and has urged caution in responding to unexpected requests for personal information. Updates will be provided as the investigation progresses.

Details of the IT security incident and response

The Housing Ombudsman Service revealed that unauthorised access occurred to data stored on its case management system, which is operated by a third-party provider. The service has taken the affected system offline to prevent further unauthorised activity and is collaborating with technical security specialists to assess and contain the breach.

At present, the full extent of the data involved remains unclear. The Ombudsman is awaiting detailed information from the supplier to establish precisely what personal information may have been accessed or compromised. The service has committed to contacting individuals directly if their data is confirmed to be affected.

In addition to notifying the Information Commissioner’s Office, the Ombudsman has advised all stakeholders to maintain vigilance against suspicious communications, especially unexpected emails, phone calls, texts or letters that request personal details. They recommend verifying the identity of any requester before disclosing information and caution against clicking on unknown links or attachments.

Context and implications for landlords and letting agents

The Housing Ombudsman plays a key role in resolving disputes between landlords, letting agents and tenants in the private rented sector. Its case management system holds sensitive information including tenancy details, complaint records and correspondence. A data breach affecting this system could expose confidential information, potentially leading to identity theft or fraud.

For landlords and agents, this incident underscores the importance of robust data security practices when handling tenant and property information. It also highlights the risks posed by third-party suppliers in the property sector, who often provide essential IT and management services but may introduce vulnerabilities.

The incident may prompt landlords and letting agents to review their own data protection measures and supplier arrangements. Ensuring compliance with data protection laws such as the UK GDPR and the Data Protection Act 2018 remains critical, especially as regulatory scrutiny intensifies.

Practical considerations following the breach

Landlords and agents should be alert for any suspicious communications purporting to come from the Housing Ombudsman or related organisations. Phishing attempts often increase after data breaches, seeking to exploit compromised information.

It is advisable to remind tenants about the importance of verifying the identity of anyone requesting personal or financial information. Maintaining clear records of all communications with tenants and the Ombudsman can assist in identifying fraudulent activity.

Those managing rental properties should also check that their own IT systems and third-party providers have adequate security measures, including regular audits, encryption and incident response plans. Prompt reporting of any suspected breaches to the Information Commissioner’s Office is essential.

Uncertainties and ongoing developments

The investigation into the Housing Ombudsman’s IT security incident is ongoing, with key details still emerging. It is not yet confirmed which categories of personal data were accessed or how many individuals may be affected.

The timing and scope of any direct notifications to affected parties depend on the findings from the supplier and technical experts. The incident also raises questions about the resilience of outsourced IT systems serving the housing sector and the adequacy of contractual safeguards.

Landlords and agents should monitor official updates from the Housing Ombudsman and the Information Commissioner’s Office. They should also watch for any changes in regulatory guidance or enforcement priorities relating to data security in the private rented sector.

Steps landlords should take now

• Review data protection policies and ensure compliance with UK GDPR and Data Protection Act 2018 requirements.
• Check the security credentials and incident response procedures of any third-party IT suppliers or management platforms used.
• Advise tenants to be cautious about unsolicited requests for personal information and provide guidance on recognising phishing attempts.
• Keep detailed records of all communications with tenants and the Housing Ombudsman to support any future investigations or disputes.
• Report any suspicious activity or suspected data breaches promptly to the Information Commissioner’s Office and seek expert advice if needed.

Supporting landlords with compliance and data management

The Landlord Association (TLA) offers members access to compliance resources and tools designed to help manage property records and tenant communications securely. TLA’s new property management and compliance platform, ORBIT, currently in BETA testing, aims to assist landlords and letting agents in organising rental documents and monitoring regulatory developments.

ORBIT is being developed to support landlords in recording repairs, inspections and communications, as well as maintaining evidence of compliance with data protection and tenancy regulations. While still in testing, ORBIT may become a valuable aid in managing the complexities of data security and regulatory obligations in the private rented sector.

Membership also provides access to practical information on data protection, tenancy agreements and notices through the TLA AI Document Studio, helping landlords prepare for evolving compliance demands. Exploring TLA membership can offer landlords and agents additional support in responding to incidents like the Housing Ombudsman breach and maintaining robust data security practices.

For more information, visit TLA’s ORBIT platform and explore TLA landlord membership options.

The Housing Ombudsman Service’s investigation into this IT security incident will continue, with further updates expected. Landlords and agents should remain vigilant and review their data protection arrangements accordingly.

Sources: Housing Ombudsman