UK Housing Ombudsman Service investigates 'security incident'

The U.K. Housing Ombudsman Service is investigating a third-party IT security incident that impacted its case management system on Tuesday.

Established under the Housing Act 1996, the Housing Ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities, and Local Government.

The watchdog settles disputes between social housing residents and social landlords in England, including housing associations, landlords, managers, and letting agents.

On Tuesday, the service added an alert to its official website, warning that it's working with the affected service provider to assess the incident's impact and said social housing residents cannot file new complaints until systems are back online.

Those who must raise new complaints are advised to call the Housing Ombudsman's phone line or email the watchdog at [email protected].

"The incident has been contained, and we are working with our external supplier to establish the full facts, including the extent of the data involved," the service said. "We are continuing to investigate whether any personal information has been affected and will provide further updates as soon as we are able. "

Housing Ombudsman Service alert (BleepingComputer)

The Housing Ombudsman service has also notified the Information Commissioner's Office (ICO) of the incident and advised tenants and leaseholders to be wary of potential scams when receiving unsolicited messages.

"As a precaution, we recommend that individuals continue to exercise their usual caution when responding to unexpected communications," it added. "Do not disclose personal information unless you are confident of the identity of the requester and report any suspicious activity to the relevant organisation or authorities. "

The watchdog is working to restore its services "as quickly as possible" and will share further updates on the investigation as soon as they're available.

In March, the British government agency Companies House, which operates the registry for all U.K. companies, was also forced to take its WebFiling service offline to fix a security flaw that had exposed companies' information since October 2025.

Two months earlier, in January, the United Kingdom announced a new cybersecurity strategy, backed by more than £210 million ($283 million) and aiming to boost cyber defenses across government departments and the wider public sector.