LAHSA takes its computers offline over a possible security breach

LAHSA, the Los Angeles Homeless Services Authority, has taken its internal computer systems offline after what it calls a potential security incident. The shutdown began with an email to staff on Friday, Nov. 6, with the subject line "Urgent: Log Off and Shut Down for the Week," LAist reported. Employees were told to stop work, turn off their machines and stay off agency systems, including email, until they received an all-clear.

The agency has not said whether anyone got into the information it holds. Interim CEO Gita O'Neill told LAist that LAHSA did not "yet have enough information to say definitively whether any sensitive or confidential personal information was accessed." In a statement issued Monday, the agency said it took internal systems offline as a precaution, that outside cybersecurity specialists are working to determine the nature and scope of the incident, and that LAHSA remains open.

The data at the center of the question sits in the Homeless Management Information System, or HMIS. LAHSA oversees the database, which the agency itself describes as holding highly sensitive information about people experiencing homelessness across the region. According to LAist, that includes names, dates of birth, Social Security numbers and disabilities. It also holds self-reported histories of mental health conditions and substance use, income sources and domestic violence history.

LAHSA says any provider that receives U.S. Department of Housing and Urban Development funding is required to use HMIS. The agency also says the Los Angeles Continuum of Care HMIS is not connected to a federal or national data collection agency, and that its data is not passed electronically to a national database. Those statements come from LAHSA's own description of the system, as reported by Hoodline.

The privacy rules that apply are less clear-cut than they might sound. HUD guidance requires covered organizations to publish a privacy notice explaining how they handle personal information, and to use at least 128-bit encryption when HMIS data travels over the internet or public networks. HUD notes that the guidance is not law, except where it is based on existing statutes or regulations. Those standards do not establish whether anyone accessed LAHSA's data in this incident, Hoodline reported.

California's notification rule is a separate question. The state attorney general's office says state and local agencies must notify residents when covered unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. As Hoodline noted, that rule alone does not establish whether LAHSA data was accessed or whether the requirement applies here. LA Globe reported that as of Wednesday, LAHSA was not on the attorney general's public list of breach notices, which covers notices sent to more than 500 Californians.

Service providers are waiting for answers too. Leaders of three LAHSA-funded service providers told LAist on Monday afternoon that they had not received any communication from the agency about the potential cybersecurity issue. All three organizations use HMIS. A LAHSA official who spoke on condition of anonymity said the shutdown order was still in place Monday evening.

LAist's radio newsroom reported that LAHSA's chief of staff, Paul Rubenstein, said outreach teams are still in the field, providers can still use HMIS, and the agency is still placing people in housing and shelters. He said much of that work is running on workarounds and temporary procedures, and that some administrative functions and response times may be affected. He did not say which ones. Rubenstein also said the investigation is still assessing whether personal information was affected, and that if it finds that it was, LAHSA will contact those people directly.

Past breaches at a different agency explain some of the concern. The Housing Authority of the City of Los Angeles, or HACLA, said hackers got into its network in 2022 and may have accessed people's names, Social Security numbers, financial account numbers and medical information. In 2024, hackers potentially accessed names, dates of birth, Social Security numbers and phone numbers. HACLA later confirmed the 2024 breach publicly, and Forbes reported that the Cactus ransomware group claimed to have taken nearly 900GB of sensitive data. Hoodline cited Forbes for that figure, and described LAHSA's incident as distinct from HACLA's past breaches.

For anyone who wants to act now, LA Globe, citing the Federal Trade Commission, reported that a credit freeze is free at each of the three bureaus, Equifax, Experian and TransUnion. It does not affect a credit score and stays in place until it is lifted. A fraud alert is a lighter option for people in the middle of a housing search, the outlet reported, and parents can freeze a child's credit too.

What to know

• LAHSA told staff on Friday, Nov. 6, to shut down computers and avoid agency systems. The order was still in effect Monday evening, LAist reported.
• The agency said Monday it does not yet know whether personal information was accessed, and it has brought in outside cybersecurity specialists.
• The HMIS database holds names, dates of birth, Social Security numbers and sensitive personal histories, according to LAist.
• Three LAHSA-funded providers told LAist they had received no word from the agency.
• LAHSA has not said when employees can reconnect to its systems.

Our take

For the people whose information sits in that database, the questions are simple. Was it touched, and will someone tell them directly? LAHSA's promise to contact affected people is the right promise, and it should be kept in public, with dates, not only in a private letter. Trust is part of how outreach works, and a shutdown that leaves providers in the dark makes that harder. Readers who work with LAHSA or one of its partners should be able to hear the same answers as the agency. Have you heard anything from LAHSA or a provider you work with? Tell us in the comments below, or post about it on the community board.

Sources

• Hoodline: LAHSA Computer Shutdown: LA Homeless Agency Security Scare
• LA Globe: LAHSA Security Issue: How to Protect Your Personal Data
• Hot Media Digest: Homeless services agency orders staff to shut down computers after security alert

---

What do you think? Tell us in the comments below, or post about it on the community board.

LA This Weekend Team