LAHSA’s Friday order to stop work and shut down agency computers remained in effect Monday evening as the Los Angeles Homeless Services Authority investigated a potential security incident. The agency had not determined whether sensitive personal information belonging to unhoused Angelenos was accessed.
LAHSA interim CEO Gita O’Neill confirmed to LAist that she sent an email Friday telling employees to log off, shut down their computers and avoid LAHSA systems until they received an all-clear. The message, titled “Urgent: Log Off and Shut Down for the Week,” also asked staff to report unusual activity, such as files renaming themselves or unexpected pop-ups and messages. O’Neill told the station the agency did not “yet have enough information to say definitively whether any sensitive or confidential personal information was accessed.”
LAHSA said it took its internal computer systems offline as a precaution, brought in outside cybersecurity specialists and is investigating the incident’s nature and scope. O’Neill said the agency’s IT team was reviewing what happened and whether information was affected, and that protecting personal and confidential information was a top priority.
What the HMIS holds
LAHSA oversees the Homeless Management Information System, or HMIS, which holds what the agency itself calls highly sensitive information collected from people experiencing homelessness across the region. Per LAist, that includes unhoused people’s names, dates of birth, Social Security numbers and disabilities, along with self-reported mental health and substance abuse history, income sources, and domestic violence history. On its own website, LAHSA describes HMIS as a secure online database that enables organizations to collect client-level, system-wide information about people experiencing or at risk of homelessness, and notes that any provider receiving U.S. Department of Housing and Urban Development funding is required to use it.
LAHSA says the Los Angeles Continuum of Care HMIS is not connected to a federal or national data collection agency and that data is not passed electronically to a national database. HUD Exchange guidance requires Covered Homeless Organizations to publish a Privacy Notice explaining how they handle personally identifiable information and to use at least 128-bit encryption when HMIS data travels over the internet or public networks. HUD notes that the guidance is not law except where it is based on existing statutes or regulations.
What privacy rules mean for the investigation
HUD Exchange says HMIS privacy and security standards aim to protect personal information while permitting reasonable, responsible and limited uses and disclosures. Those standards do not establish whether anyone accessed LAHSA data in this incident. The California attorney general’s office says state and local agencies must notify residents when covered unencrypted personal information was acquired, or reasonably believed to have been acquired, by an unauthorized person. That rule alone does not establish whether LAHSA data was accessed or whether the notification requirement applies in this case.
Providers await information
Leaders of three LAHSA-funded service providers told LAist they had not received communication from the agency about the potential cybersecurity issue. All three organizations use HMIS. O’Neill has not answered questions about whether the shutdown disrupted services for unhoused people.
LAHSA said it is working with its technical and legal teams, taking steps to maintain essential operations and remains open while the investigation continues. It has not said when employees may reconnect to its systems.
A separate agency’s breach history
LAHSA’s incident is distinct from past breaches at the Housing Authority of the City of Los Angeles, or HACLA, a separate agency. HACLA has said hackers got inside its network in 2022 and may have accessed people’s names, Social Security numbers, financial account numbers and medical information. In 2024, hackers potentially accessed names, dates of birth, Social Security numbers and phone numbers.
HACLA later confirmed the 2024 breach publicly. The Cactus ransomware group claimed it had exfiltrated nearly 900GB of sensitive data, according to Forbes. HACLA said it hired external forensic IT specialists to investigate and respond. LAHSA has also brought in outside cybersecurity specialists, but the outcome of its investigation remains unknown.
