Summary
- L&Q says emails or webform messages from around 12,000 residents were accessed without authorisation.
- The organisation says banking data and its wider resident and operational databases were not affected.
- Its website and resident online services remain unavailable while investigation and recovery continue.
London housing association L&Q says a cyberattack exposed online correspondence from around 12,000 residents, while its website and resident-facing online services remain unavailable during investigation and recovery.
L&Q, which manages around 105,000 homes, has informed both the Information Commissioner’s Office and the Regulator of Social Housing about the incident.
The organisation says an unauthorised person or group accessed emails or webform messages submitted by approximately 12,000 residents. Those directly affected were contacted by email.
L&Q says its investigation has not identified access to residents’ bank details or other financial information. It also says its wider databases containing personal information, tenancy and property records, operational information, and supplier or partner data remain secure.
The distinction narrows the confirmed scope but does not make the exposed information insignificant. Messages submitted to a housing provider can contain contextual information about repairs, personal circumstances, disputes, complaints, property issues, or other matters that may be more revealing than a conventional contact database even where no financial details are present.
L&Q has not publicly established the attacker’s identity or disclosed the initial access route. It described the incident as targeted and said its security team isolated and secured the affected website after detection.
The website remains largely unavailable while the organisation works towards restoration. Residents have been directed to telephone and email channels for services in the meantime, turning the incident into an availability problem as well as a data-protection event.
For a large housing provider, digital disruption can affect a wide range of routine interactions, from reporting repairs to accessing tenancy information. Even where core housing-management systems remain intact, loss of the public-facing service layer can push demand onto contact centres and manual processes.
The involvement of two regulators reflects the dual nature of the incident. The ICO has responsibility for the handling of personal information, while the Regulator of Social Housing is concerned with the governance and service obligations of registered providers. An event affecting resident data and service availability can therefore cut across privacy, operational resilience, and sector oversight.
L&Q says it has not received reports that the information has been used maliciously. That could change as the investigation progresses, and the organisation has warned of increased fraud and phishing risk following the exposure.
The unresolved questions include how the website environment was compromised, whether the attacker accessed information beyond the correspondence currently identified, and when resident online services can be restored safely. Until those points are established, the incident remains both a data investigation and a service-recovery exercise.
