England's Housing Ombudsman Service has taken its online complaint channels offline after a security incident at a third-party IT supplier affected its case management system, the ombudsman said in a statement Tuesday. The body, which settles disputes between social housing residents and their landlords, said it does not yet know how much data is involved, a reminder that a public service's data risk often sits with the contractors that run its systems.

What Happened

In its statement, the ombudsman said it had become aware of a "third-party IT security incident" affecting the system it uses to manage cases. It said the incident has been contained and that it is working with an external supplier to establish the facts, including the amount of data involved.

The ombudsman said it is still investigating whether any personal information was affected and has reported the incident to the Information Commission, the U.K. data protection regulator formerly known as the Information Commissioner's Office. It did not name the supplier or describe what kind of attack took place.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

While the systems are offline, residents cannot submit new complaints, view existing ones or use the web chat and online form. The ombudsman is directing people with new complaints or general questions to email or phone instead, and it gave no date for restoring service. It also urged residents to be cautious about unexpected messages, not to share personal information unless they are sure who is asking, and to report anything suspicious. That advice reflects a common risk after data incidents: criminals sometimes use stolen or leaked details to make scam messages look genuine.

BleepingComputer, which reported the incident Tuesday, said no group had claimed responsibility. It noted that the ombudsman is an executive non-departmental public body sponsored by the Ministry of Housing, Communities and Local Government and was set up under the Housing Act 1996.

Why It Matters

Case files at a housing complaints service can contain sensitive material about tenants, such as their homes, their disputes with landlords and their contact details. If personal data turns out to be involved, the ombudsman and its supplier will face questions about what was held, for how long and under what security terms.

Under the regulator's breach reporting guidance, organizations must tell the regulator "as soon as possible, and where feasible within 72 hours" when a breach is likely to pose a risk to people, and must inform affected individuals without undue delay when that risk is high. The ombudsman's early report to the ICO, before it has confirmed what data is involved, follows that approach.

For leaders of public bodies and the companies that serve them, the incident is another example of a single outsourced platform taking a core service offline. The outage halts the main way residents start a complaint, shifting the load to phone and email teams. Contracts that cover hosted case management systems need clear terms on incident notification, forensic access and how quickly the supplier must help the client meet its own reporting duties.

The ombudsman is not the only U.K. public body to run into trouble this year. BleepingComputer recalled that Companies House took its WebFiling service offline in March to fix a security flaw that had exposed company information since October 2025.

What to Watch

The key open questions are whether residents' personal information was taken and, if so, whose and how much. Watch for the ombudsman to name the supplier, say whether other clients of that supplier were affected and set a date to restore online complaints. A claim on a criminal leak site, or ICO action, would also change the picture.