Britain’s largest housing association has still not restored its computer system, four weeks after a “cyber attack” brought it down, leaving thousands of tenants unable to get repairs done, or knowing if their personal data has been breached.
In mid-June Clarion Housing sent out emails asking residents in its 125,000 homes not to contact them except in an emergency as they were having “issues” with their computer system.
Then on 23 June they announced that the “disruption has been caused by a cyber security incident and we are working urgently to restore our systems”.
Clarion has numerous properties in Fitzrovia. One tenant told Fitzrovia News that they had received an email saying not to contact the housing association except in an emergency. Their direct debit monthly rent payment had also not been processed by Clarion.
But it appears many residents received no direct communication from Clarion and only heard about the problem through social media.
IT engineer Daniel Beal told east London news site the Havering Daily that his neighbours had been left in the dark about what has happened.
“I have been helping and advising people what to do next as many fear that their bank details stored on Clarion’s IT systems have now been compromised,” he said.
“It has been awful. It really is standard practice that people should be notified about what is happening, yet four weeks and we have heard nothing,” he said.
The Social Housing Action Campaign (SHAC) held an online meeting on 13 July where they heard concerns from Clarion residents about their personal details been possibly stolen by the attackers.
SHAC says that Clarion “appears to have been totally unprepared and without an adequate contingency plan” for the cyber attack.
SHAC have advised residents to be extra vigilant about spam and “phishing activity”.
Clarion has yet to give details about the nature of the cyber attack and has not said that any residents’ data has been breached.
On 13 July Clarion issued a short statement saying:
“We’re very sorry, but we’re continuing to experience IT system issues,” it said.
But it continued to only give scant details of what had happened.
“This disruption has been caused by a cyber security incident and it may take some time to bring our systems fully back online, as it is important that we do so in a safe and secure way.”
As of today, the official line from Clarion is: “We rapidly engaged the help of our cyber security partner and they have been helping us to investigate what happened.”
Update, 5 August 2022: Clarion says there continues to be “disruption to our services” — seven weeks after the cyber attack that crippled its computer system. Addressing concerns about residents’ personal data, Clarion said its “main repository in which personal data is stored” was “not accessed” but they are “still investigating the extent to which data stored elsewhere may have been impacted”.