Housing Ombudsman case-system incident: 8,783 determinations in 2025-26, and no count, supplier or date stated

The scale is published; the incident's scale is not

The Housing Ombudsman Service says it made 8,783 determinations in 2025-26, and its Annual Complaints Review says 1,670 member landlords represent "just over 5 million households" who can come to it. On 13 October 2026 it published a statement that "a third-party IT security incident" has "impacted our case management system". The first figures are the Ombudsman's own. The statement says nothing about how many of those cases, people or households sit in the affected system: it gives no count, no data categories, no supplier and no incident date.

The statement's page data gives its first publication as 10:16:11 UTC, which is 11:16 BST on Tuesday 13 October. At 06:43 BST on Wednesday 14 October the homepage banner still said residents would be "unable to submit a new complaint, view an existing complaint, or use our web chat or webform". That is at least 19 hours 26 minutes with the online route closed (derived: 11:16:11 to 06:43 BST), and the figure only grows. It is a floor, because the statement does not say when the outage began, or when the route will return. The gap between the incident and the alert cannot be computed at all: the page states neither an incident date nor the time the Ombudsman became aware. BleepingComputer says the incident affected the system "on Tuesday", the same day the statement appeared.

There are two accounts of this incident from the Ombudsman, at two levels of certainty. The public statement says the Ombudsman is "continuing to investigate whether any personal information has been affected". Inside Housing, a sector paper, reports that emails "seen by Inside Housing" went to those affected earlier on 13 October, and quotes them as saying that "some contact details such as name, address, telephone number and postal addresses may have been copied from our system". This briefing did not see that email, and the Ombudsman's website does not mention it. The public statement, unchanged when it was re-read at 06:43 BST on 14 October, still asks only whether any personal information has been affected.

This briefing reads the Ombudsman's own pages first: the statement, the homepage banner, its Annual Complaints Review, its annual report and accounts, its privacy notice and its data protection report. BleepingComputer, Housing Today and Inside Housing are secondary, used for what they report and not as proof. Everything was read between 06:19 and 06:43 BST on Wednesday 14 October 2026. BleepingComputer's page data gives 14:19:44 at a UTC offset of minus four hours, which is 19:19 BST; its time is US Eastern. No form was filled in or submitted. In a limited search, no supplier statement and no statement about this incident from the regulator, the NCSC or the sponsoring ministry was found.

How large the case load is, from the Ombudsman's own figures

The Ombudsman publishes enough to size what it handles, though not what an incident touched. Every figure below is stated by the Ombudsman unless it is marked derived, which means this briefing did the arithmetic.

Scale figures from the Ombudsman's Annual Complaints Review 2025-26, its news item of 15 September 2026, its Annual Report and Accounts 2024-25 and its dispute resolution privacy notice. Derived figures are labelled.

Figure	What the Ombudsman published	What it can and cannot say here
Member landlords	1,670 at the end of 2025-26, together representing "just over 5 million households".	The reach of the scheme. Households, not people, and not a count of who is in the affected system.
Determinations	8,783 in 2025-26. 7,008 in 2024-25. Difference 1,775 (derived), which fits the review's "almost 2,000 more cases".	Cases decided in a year. About 24 a day (derived: 8,783 divided by 365). One resident can have more than one case.
Findings	20,016 category findings in 2025-26. About 2.3 findings per determination (derived).	Inside Housing wrote "more than 20,000 cases". The review's 20,016 counts findings. The case count is the smaller 8,783.
Complaints and enquiries received	44,508 in 2024-25, 40,945, 32,126, 26,259 and 15,914 in the four years before it. Five-year sum 159,752 (derived).	Contacts, not people. Whether the case management system holds enquiries as well as cases is not stated.
Cases entering formal remit	11,349 in 2024-25, then 8,176, 5,109, 4,001 and 2,253. Five-year sum 30,888 (derived).	Formal cases over five years. The statement does not say which years the system holds.
Retention	Electronic documents "generally deleted three years from the date of closure of a case". Case management workflow parties' details anonymised "after seven years". Telephone recordings deleted after 6 months.	Sets how far back records could reach, up to seven years for party details (inference). What the affected system holds is not stated.
Disability reported	33% of residents whose case was determined in 2025-26 said they have a disability; 38% did not respond. About 2,900 of 8,783 (derived).	Shows how often case files can carry health information. The product treats determinations as residents, so it is approximate.

None of these is a count of people in the incident. They set the neighbourhood: the Ombudsman's own tables sum to 30,888 formal cases and 159,752 complaints and enquiries over the five years to 2024-25 (derived). Separately, the Ombudsman determined 8,783 cases in 2025-26. Whether the affected system holds any of that, all of it or only an administrative subset is what the statement leaves open.

What kind of data the Ombudsman handles is also published. Its dispute resolution privacy notice lists "name and address", "family details", "details of your complaint", "photographs/videos", "sound recordings" and "details of personal behaviour". It lists special categories including "health or medical information as relevant to our consideration or investigation" and equality data on ethnic origin, disability, religion, sexual orientation and more. It also says it holds "health and vulnerability data for the management of any requested reasonable adjustments", and keeps details of people it considers present unacceptable behaviour. Which of those sit in the affected system is not stated. The only categories named anywhere are the ones in the email Inside Housing quotes: contact details.

Stated and not stated: the record, line by line

The table sets what the Ombudsman has stated against what it has not. "Not stated" means not found in the Ombudsman's statement, banner, annual report, privacy notice or data protection report, all read in full. It does not mean the information does not exist. Items that rest on Inside Housing's report of an email are marked as such.

What the Housing Ombudsman Service has published about the incident (statement of 13 October 2026, homepage banner) and what it has not. Inside Housing is named where it is the only source.

The question	Stated	Not stated
What happened?	"We are aware of a third-party IT security incident that has impacted our case management system."	Whether it was an attack, an error or a supplier breach. The word cyberattack is Inside Housing's and Housing Today's, not the Ombudsman's. How it began. Ransomware or any other kind.
When?	Statement first published 11:16 BST on Tuesday 13 October (page data). The page says "Last updated: 13 October 2026 11:00", with no time zone.	When the incident began, when it was detected, when the supplier told the Ombudsman, when the regulator was told. The visible 11:00 is earlier than the page data if read as BST, so the clock here uses the page data.
How many people?	The Ombudsman is working to establish "the extent of the data involved". Inside Housing says it "is unable to confirm how many people have been affected at this stage".	Any number of people, cases, households or records. How many emails were sent.
What data?	On the website: "whether any personal information has been affected". Per Inside Housing's quotation of the email: contact details "may have been copied".	On the website, any category. Whether case content, health or vulnerability notes, photographs, recordings or landlord staff details were in the system.
Which systems?	The case management system. Per the email as quoted: the online form, landlord portal and web chat are offline because the Ombudsman is "unable to currently access" the system.	Whether anything outside that system was touched, and whether the email, telephone or document systems are separate.
Who is the supplier?	"Our external supplier." The 2024-25 annual report refers to an "IT supplier" for the case management system.	A name, in the statement, the banner, the annual report or the data protection report. No supplier statement was found.
Who is the controller?	The April 2025 data protection report says the Ombudsman is "registered as a data controller".	The supplier's role (processor or other), the contract, who told whom and when.
What was contained?	"The incident has been contained." Per the email as quoted, "proactive, precautionary steps to prevent further unauthorised activity" were taken.	What contained means, who did it, and what forensic work has begun or finished.
The regulator?	"We have reported the incident to the Information Commission." Per Inside Housing, the Ombudsman "has spoken to the ICO".	When. Whether it was a notification under Article 33. What it said.
What can residents do?	No new complaint, no viewing an existing one, no web chat or webform. Email or phone for a new complaint.	A restoration time. How existing deadlines are treated. Which instruction applies: the contact page still says "We do not accept new case enquiries sent to us via email", and the banner asks people to email. That page also says new enquiries were already taking up to 20 working days.
When is the next update?	"Will provide further updates as soon as we are able."	Any time or interval.
Who is safe?	"Usual caution" with unexpected communications.	Whether a person who received no email can treat themselves as unaffected. L&Q's website, as Inside Housing quoted it on 28 September, said so; the Ombudsman's page does not.

The gap that matters most is not any single blank. It is the difference between two channels. The public page asks whether any personal information has been affected. The email, as quoted, tells recipients contact details "may have been copied". A resident who reads only the website, where the banner and the statement sit, sees the more tentative account. A resident who got the email sees the more specific one. Neither says how many people, and neither says which people. L&Q, a landlord, gave a count and a rule in its September notice, as Inside Housing reported it: "approximately" 12,000 residents, and that a resident who had not received a message "will not have been affected by this issue". The Ombudsman's page offers neither a count nor a rule.

Who has to tell whom, and what is on the record

UK GDPR sets a chain of notices after a personal data breach. A processor tells the controller. The controller tells the regulator, within 72 hours where feasible, and tells people directly when the risk to them is likely to be high. The diagram puts each link beside what the Ombudsman's record shows for it. Three of the four links have a blank where a time or a number would be.

The 72 hours need a start time, and the record gives none. Take the outer bound: the Ombudsman became aware no later than the moment it published its statement. Then its window to notify the regulator closed no later than 11:16 BST on Friday 16 October (derived: 11:16:11 BST on 13 October plus 72 hours). The statement says the incident has been reported, so that window may already have been met. It does not say the report was a notification under Article 33, and the content that Article 33(3) requires, including "the categories and approximate number of data subjects concerned", is not public. Article 33(4) allows the information to be given in phases, so a report with no number is not by itself a failure. The deadline people quote runs to the regulator, not to the public, as this site set out in an earlier briefing on a police force incident.

Seven labels, and what each tells a complainant

A comforting label is not a control, and an alarming one is not a finding. Seven labels appear in this story, in the Ombudsman's words, in its earlier reports and in the press.

Labels in the record, where each appears and what the record shows.

The label	Where it appears	What the record shows
"Third-party IT security incident"	Ombudsman statement and banner.	A category, not a cause. Housing Today and Inside Housing write "cyber attack" and "cyberattack". The Ombudsman's statement does not use either word. The email as quoted refers to "unauthorised activity", which suggests someone acted without authority (inference).
"Has been contained"	Statement. The email as quoted: "We have contained the incident."	Contained is not resolved. The email also says the Ombudsman is "unable to currently access" the system, so containment looks like a shutdown (inference). What was contained, by whom and how: not stated.
"As a precaution ... usual caution"	Statement.	The advice is to keep doing what a resident would do anyway. It does not say which messages to expect, which numbers or addresses to distrust, or what a genuine message from the Ombudsman about this will look like.
"Reported the incident to the Information Commission"	Statement.	A report is not a finding. The regulator's legal name changed on 30 September 2026: the ICO's own page says the legal entity is the Information Commission, and legislation.gov.uk shows Article 33 amended that day. BleepingComputer, Housing Today and Inside Housing still wrote "Information Commissioner's Office". The Ombudsman's wording is the current one.
"External supplier"	Statement. The annual report 2024-25 says "IT supplier".	A relationship with no name. Neither document names the company, its role or its contract.
"Cyber Essentials and Cyber Essentials Plus: accreditations in place"	Annual report 2024-25, strategic risk table.	A certificate covers the scope the organisation declares and five technical controls. Version 3.3 says cloud services holding your data must be in scope and the applicant is "always responsible for ensuring all controls are implemented". Whether the case management system was in scope is not stated, and no certificate says a supplier-side incident cannot happen.
"Will provide further updates as soon as we are able"	Statement. The banner: "share updates when we can".	No time is given. The Ombudsman's Complaint Handling Code, section 8.5, tells a landlord that cannot comply "due to exceptional circumstances, such as a cyber incident" to inform the Ombudsman, give information to residents who may be affected, publish it and "provide a timescale". That binds landlords, not the Ombudsman. It does show what the Ombudsman expects an affected organisation to say.

Method is separate from accusation. On the record the Ombudsman has published a statement on 13 October, put a notice on its site, named a Data Protection Officer contact, told the regulator, offered phone and email routes, and, as Inside Housing reports, written to people it believes affected. Two sector papers moved the label from "incident" to "cyberattack" within hours of the statement: Housing Today at 12:15 BST and Inside Housing at 14:15 BST (page data). The gap is in what the public record says, not in whether the Ombudsman acted.

A supplier with no name, and what was published before

The Ombudsman's own data protection report says it is a registered data controller, and the NCSC's position is that accountability does not move with the data. What a reader can check is what the Ombudsman published about its systems and suppliers before 13 October. None of it describes this incident.

What the Housing Ombudsman Service published before the incident about its case management system, supplier assurance and recovery planning.

Published	Source and date	What it does not say
A strategic risk, "Resilience of key business systems": "Ongoing work with IT supplier: to assess risk, resilience and performance of case management system (CMS), including recently completed system review", and a "CMS development group".	Annual Report and Accounts 2024-25, signed 10 December 2025.	The supplier's name, the contract, the review's findings, or whether the review covered security.
Supplier assurance: the work "is currently done but will benefit from standardisation", and "Due to resourcing shortages this work has had to be deferred until 2025-26".	Data Protection Annual Report 2024-25, April 2025.	Whether the standard process was delivered in 2025-26, or whether it covered this supplier.
Recovery: "quarterly test exercises" with "a suite of disaster recovery responses covering common cyber security issues", and an internal audit of "Cyber-attack restoration and recovery preparations (substantial opinion)".	Annual Report and Accounts 2024-25.	Whether either covered a supplier-side incident or the case management system, or what recovery time was tested.
Sponsor oversight: "We held 2 deep dives in-year exploring our cyber security preparedness" with the sponsoring ministry.	Annual Report and Accounts 2024-25.	What the deep dives found.
A 2026-27 activity: "work with a digital design and delivery partner to support our technology ambitions focusing on key business systems replacement".	Business Plan 2026-27, April 2026.	Whether the affected system is one of those to be replaced.

This shows a case management system, an IT supplier for it and a recorded risk about its resilience. It does not show a failing, and 18 months separate the data protection report from the incident. A missing supplier name is not unusual. This site has covered another organisation that cited third-party platforms without naming one. The cost to a complainant is concrete, though. A person cannot ask a supplier about their data without knowing who holds it, and so depends on the Ombudsman's Data Protection Officer to answer for the supplier.

The UK rules as read: data protection, the regulator and public-sector guidance

Two sets of documents bear on this incident: data protection law and its regulator's guidance, and public-sector cyber and supply chain guidance. Quotations are short and exact, read on legislation.gov.uk, ico.org.uk, ncsc.gov.uk and gov.uk on 14 October 2026.

UK GDPR and ICO guidance as read on 14 October 2026, with what each leaves open about this incident.

Instrument	What it says	What it does not settle here
UK GDPR Article 33	The controller notifies "without undue delay and, where feasible, not later than 72 hours after having become aware", unless a risk to people is "unlikely". A late notice needs reasons. "The processor shall notify the controller without undue delay after becoming aware". A notice describes the breach, "categories and approximate number of data subjects", a contact, likely consequences and measures, and may come in phases.	When the Ombudsman became aware, whether it judged a risk likely, and what its notice said.
UK GDPR Article 34	When a breach "is likely to result in a high risk", the controller communicates it to the person "without undue delay", in "clear and plain language", with the contact, likely consequences and measures. Exceptions include encryption and "disproportionate effort", in which case a public communication is required instead.	Whether the Ombudsman judged the risk high, whether the email is an Article 34 communication, and how many people got it.
UK GDPR Article 28	A controller uses only processors giving "sufficient guarantees". The contract sets out the categories of data and people, and the processor "assists the controller" on Articles 32 to 36 and allows audits. A processor that decides the purposes and means "shall be considered to be a controller" for that processing.	The contract, the supplier's role and its terms. None is published.
ICO guide to personal data breaches	Report "within 72 hours of becoming aware" and provide what you have, adding later. A processor that suffers a breach "must inform you without undue delay", and breach-reporting terms "should be detailed in the contract". The page notes the guidance is under review after the Data (Use and Access) Act.	Anything about this incident. No statement from the regulator was found.
ICO advice for people, page dated 2 October 2026	An organisation "has 30 days to acknowledge your complaint" and should be able to "confirm if your information was involved". People can complain to the ICO afterwards. Advice covers watching for scam calls, emails and texts, bank and credit checks, Cifas protective registration (fee), and contacting the police if safety is a concern.	The 30 days is for acknowledging a complaint. It is not a deadline for telling people whether they were affected.
The regulator's name	The ICO's page of 30 September 2026 says the legal entity is now the Information Commission, "referred to as the Information Commission's Office, or ICO". Article 33 on legislation.gov.uk shows the substitution on 30.9.2026.	Nothing about the incident. It explains why the Ombudsman's wording differs from the press.

Public-sector, supply chain and certification guidance as read on 14 October 2026, with where each stops.

Instrument	What it says	Where it stops
NCSC supply chain security guidance (reviewed 22 October 2025)	With cloud suppliers, "it is not possible to transfer complete responsibility or accountability for protecting information to the provider of that service". Contracts should cover security "including termination and the transfer of services", and a "right to audit", which "might not always be possible or desirable" for cloud.	Guidance for large organisations and the public sector. Does not set a notice period or mention this incident.
NCSC incident management (version 1.0, 2019)	Exercise the response and "review your capabilities (including those of any 3rd party service providers)". Document what "constitutes a reportable incident", including "any data held by suppliers", and keep communications plans for when normal channels fail.	An older page with no timescales.
NCSC Cyber Assessment Framework 4.0, A4 supply chain	An organisation relying on third parties "remains accountable". "You do not know what data belonging to you is held by suppliers, or how it is managed" is Not achieved. Achieved includes responsibilities "defined in contracts" and supplier incident processes that provide "mutual support".	Written for essential functions. Not stated whether it applies to the Ombudsman.
Government Cyber Action Plan (DSIT, 6 January 2026)	Arm's-length bodies are "accountable for their own cyber security and resilience" to their sponsor, and organisations "are responsible for managing the cyber risk posed by suppliers they use". A case study praises the Irish health service for "radical transparency" and "regular, public updates".	A programme with milestones to 2027 and 2029. Names no notice period for public updates. Its definition of arm's-length bodies includes non-departmental bodies, which GOV.UK says the Ombudsman is (executive, sponsored by the housing ministry), but it does not name the Ombudsman.
Cyber Essentials requirements v3.3 (April 2026)	Cloud services holding your data "cannot be excluded from scope", and the applicant "is always responsible for ensuring all controls are implemented", whichever party implements them.	Five technical controls on the declared scope. Not an assurance about detection or a supplier's own incident.
Cyber Security and Resilience Bill	The stages page lists Lords report stage for 26 October 2026, marked provisional, read at about 06:27 BST on 14 October. Not law.	Its text was not read for this briefing, so no view is offered on whether it would reach a case management supplier.

The documents agree on one point and leave one open. They agree that using a supplier does not move accountability: the NCSC, the Cyber Essentials requirements and the Government Cyber Action Plan all say so in their own terms. They leave open what a person affected is told, and when. The 72 hours runs to the regulator. The Article 34 duty applies only to a high risk. Between the two, what reaches a complainant is the controller's judgement.

What to do, in the order worth doing, for three audiences

Each list is ordered by what to do first. None is legal advice, and none assumes more than the record establishes. Where a step relies on the Ombudsman's own pages, those pages carry the phone number and addresses, which this briefing does not reproduce: use the Ombudsman's own website, not a number or link in anything sent to you.

What could not be verified

• The email. Inside Housing's quotation of an email to affected people was not independently seen. The Ombudsman's website does not mention it. Its date and time, recipients and full text are unknown.
• The supplier. No primary names it. The privacy notice names a portal supplier. No source links that company to the incident and this briefing does not.
• Cause, data, count, date. Not stated by the Ombudsman. Cause, data taken, number of people and the incident date are all unknown.
• Regulator, NCSC and ministry. No statement about the incident from the Information Commission, the NCSC or the sponsoring ministry was found, in a limited search.
• Whether the 72 hours was met. The start is not public. The 16 October date is a derived outer bound on the generous reading, not a finding.
• What the case management system holds. The scale figures are the Ombudsman's published case load. They are not the contents of the affected system.
• The Bill. Its stages page was read in a browser; its text was not.
• Not read. NCSC supply chain principles other than 4 to 6 and 10, any supplier's website, and social media.
• Other outlets. Computer Weekly and UKAuthority answered scripted requests with a block page and were not read. The Register, Public Technology and the 24housing site showed no coverage when checked.
• Press timing. BleepingComputer's "on Tuesday" is its own wording. The contact page's email wording may predate the incident.
• Time-stamped. Sources were read between 06:19 and 06:43 BST on 14 October 2026. The banner, the statement or a new report could change within hours.

The question that exposes the gap

When a supplier's platform is down and the regulator has been told, whose incident is it, and what does a complainant get told: a count, a date, a supplier's name, or "usual caution"?

Key facts