Investigations into a cyber attack that affected thousands of Greater Manchester residents have not yet identified who was responsible, the housing provider L&Q has said.
L&Q Housing, which has offices in Old Trafford, saw its systems breached by hackers at the end of September. Emails and webforms sent by around 12,000 residents were accessed 'without authorisation', prompting the company to launch a 'comprehensive' investigation into how this could have happened.
An update emailed to residents on Tuesday, October 27, and seen by the Local Democracy Reporting Service, reveals that those investigations have not 'yet provided any indication of who might have been responsible'.
No reports of malicious use
L&Q also said it has had 'no reports of anyone attempting to use the information accessed maliciously', adding it has 'seen no further unauthorised attempts to access [its] systems'.
The firm previously stated it believed the incident to be limited to online contacts from residents, with systems containing residents' personal details, financial information, data about homes and tenancies, and information relating to suppliers and partners remaining 'secure'.
L&Q manages one of the largest portfolios of affordable homes in Trafford borough, along with homes in London, the south east and the wider north west.
Website restoration underway
Much of the company's online services were taken offline following the attack while L&Q took steps to ensure it could restore the site 'safely and securely'. While 'basic information pages' are now live once more, L&Q said online payment tools and enquiry forms are not 'yet available'.
The company hopes these will be reintroduced 'over the coming weeks' after 'further security testing' takes place. L&Q added it is bolstering its systems with 'enhanced security measures' which include 'robust cyber-security monitoring'.
The email from the company said: “Again, we are very sorry for any concern this incident has caused. We’d like to reassure you that we continue to have had no reports of anyone attempting to use the information accessed maliciously, and we have seen no further unauthorised attempts to access our systems.
“We’re also doing everything we can to maintain the safety of residents, and L&Q’s wider IT systems. We have reintroduced the website with enhanced security measures, including robust cyber-security monitoring, with additional support from independent online security specialists.
“Alongside this work to restore our website and online services safely, we are also continuing our investigation into the original security incident, including thoroughly reviewing the information that may have been accessed. Several residents have asked if we have been able to find out who was behind the attack, but unfortunately, our investigations haven’t yet provided any indication of who might have been responsible.”
Residents advised on safety
Residents are advised to not give out their bank details to anyone claiming to be from L&Q, saying its teams would never ask people to confirm their identity through these details. People should also not let anyone into their homes without a prior appointment and to call the contact centre if they are in doubt as to whether an appointment is legitimate.
If residents are unsure if a call is genuine, they can request the operative call back using the contact centre phone number to check. Links and attachments from unknown senders should not be opened.
Fiona Fletcher-Smith, chief executive at L&Q, said: “We are continuing to manage the cyber security incident that has affected L&Q’s website, and we’re pleased to have been able to start reintroducing the site earlier this month. Our priority is making sure both residents and L&Q’s wider systems are safe and protected, so we are restoring the website in a careful, step-by-step way, and we intend to reintroduce wider functionality as soon as we can, following further security testing.
“We have also reintroduced the website with enhanced security measures, including robust cyber-security monitoring, with additional support from independent online security specialists. We continue to keep directly affected residents updated, including offering advice and guidance about their online safety.
“I want to again apologise for any worry or inconvenience this may have caused, and thank everyone for their patience and understanding as we work to fully and safely restore our online services.”
