Los Angeles housing authority HACLA confirms second ransomware attack

The Housing Authority of the City of Los Angeles confirmed at the start of November 2024 that its IT network had been attacked, after the Cactus ransomware group added the agency to its extortion site.

Cactus claimed to have taken about 861 gigabytes of files, describing the haul as personally identifiable information belonging to executives, employees and clients, together with database backups, financial records and internal correspondence. HACLA did not confirm the figure or say which categories of resident data were involved.

In a statement the agency said it had been affected by an attack on its IT network and had hired external forensic IT specialists as soon as it became aware of the intrusion. It said its systems remained operational and that it was continuing to deliver services to low income and vulnerable residents. No ransom demand was disclosed.

HACLA is one of the largest public housing agencies in the United States, managing thousands of affordable units across the city. It was also breached by the LockBit ransomware group in an incident disclosed in 2023, in which attackers had access to its network through much of 2022 and resident and employee data was leaked.

As of the first week of November 2024 the investigation was continuing and the agency had not published a notification stating how many people were affected.