Los Angeles housing agency confirms another cyberattack after 2023 ransomware incident

The Housing Authority of the City of Los Angeles (HACLA) said it is dealing with a cyberattack following claims of data theft made by a ransomware gang.

In a statement to Recorded Future News, a spokesperson for HACLA confirmed that it has “been affected by an attack” on its IT network.

“As soon as we became aware of this, we hired external forensic IT specialists to help us investigate and respond appropriately,” the spokesperson said. “Our systems remain operational, we’re taking expert advice, and we remain committed to delivering important services for low income and vulnerable people in Los Angeles.” 

The statement came after the Cactus ransomware gang recently claimed it stole 861 GB of data that included personal information, backups, financial documents and more. 

The ransomware group emerged in March 2023, initially focusing on exploiting vulnerabilities in virtual private network (VPN) appliances to gain initial access to the networks of large companies. Microsoft said last December that it saw the group using malware distributed through online advertisements as a precursor to infecting victims with the ransomware.

Since then, the ransomware gang has claimed responsibility for damaging incidents involving cold storage giant Americold, one of Sweden's largest supermarket chains and French multinational Schneider Electric.

This is the second cyberattack HACLA has faced in recent years after the now-defunct LockBit ransomware gang breached the organization in 2023. 

HACLA is one of the nation’s largest and oldest public housing authorities. The agency has an annual budget of more than $1 billion and provides housing to more than 19,000 families in the city.

Ransomware gangs have targeted multiple housing authorities for U.S. municipalities in recent years aiming to steal data from some of the country’s most vulnerable residents. 

Housing authorities in San Bernardino County, Raleigh, Indianapolis, Cleveland and Chattanooga have all dealt with ransomware incidents over the last two years. 

On Thursday, the Houston Housing Authority was listed on the leak site of another ransomware gang but did not respond to requests for comment.