Update: the Housing Ombudsman says the IT breach is under control and the probe with the supplier is moving forward, while urging users to stay alert.
The Housing Ombudsman Office issued a fresh briefing on Tuesday, confirming that the recent third-party IT security incident affecting its case management system remains under active investigation. Earlier statements had already assured the public that the breach had been isolated, and today’s message adds that forensic work with the external supplier is progressing at a steady pace.
Investigators have identified the initial entry point, applied containment protocols, and are now analysing log files to determine the full scope of the compromise. While no evidence of widespread data extraction has emerged, the team continues to monitor for any delayed activity.
The office emphasises that the situation is being handled with the same rigor applied to any major cyber-security event.
Investigation status and containment
Technical experts from both the Ombudsman’s internal security unit and the supplier’s incident-response team have completed the first round of system integrity checks.
These checks have validated that the core database is currently inaccessible to unauthorised users, and that all backup environments have been scanned for hidden artefacts. The joint task force is now focusing on a deeper review of user-access logs dating back twelve months, aiming to identify any anomalies that could indicate covert data harvesting. As part of the remediation plan, a series of software patches will be deployed over the next week, followed by an independent audit to certify that the case management platform meets the highest standards of confidentiality and availability.
Contact channels for questions and support
Direct email for incident enquiries
Any party that has already raised a concern via [email protected] will receive a response as soon as the backlog is cleared. The office asks callers not to duplicate messages, as doing so could delay the handling of each query. For those who have not yet made contact but wish to discuss the breach, the same address remains open and is monitored by a dedicated team trained in data-protection matters. Replies are prioritised on a first-come, first-served basis, and the team strives to acknowledge receipt within 48 hours.
New complaints about landlords
While the security review is underway, the Ombudsman continues to accept fresh submissions regarding tenancy disputes. Individuals who need to lodge a fresh complaint should direct their correspondence to [email protected] or call the helpline on 0300 111 3000. The telephone service operates Monday through Friday, and callers will be guided through a short verification process before their case is entered into the system. The ongoing investigation does not affect the normal processing of these new complaints.
Protecting your personal data while the inquiry continues
Even though the breach has been contained, the Ombudsman advises every stakeholder to stay vigilant against social-engineering attempts that often follow a high-profile incident. Unexpected emails, text messages, or phone calls requesting personal information—especially those that create a sense of urgency—should be treated with suspicion. Recipients should verify the sender’s identity by contacting the organisation through official channels before opening attachments or clicking links. It is also wise to review recent account activity for any irregularities and to update passwords where possible. By maintaining a cautious stance, users can help prevent secondary attacks that exploit the knowledge of a compromised system.
The Ombudsman apologises for any inconvenience caused by the temporary disruption and appreciates the patience shown by tenants, landlords, and partner agencies. Further statements will be released as new facts emerge, and the office pledges to keep the public informed with transparent, timely updates. In the meantime, the organisation remains committed to restoring full functionality to its case management platform while upholding the highest standards of data protection.
