LAHSA shuts down its computers over ‘potential security issue’

The Los Angeles Homeless Services Authority told its employees Friday to stop work, shut down their computers and stay off agency systems while it looked into “a potential security issue affecting our systems,” its chief executive confirmed to LAist.

That shutdown order was still in place Monday evening, according to a LAHSA official not authorized to speak on the record.

Gita O'Neill, the agency’s interim CEO, told LAist on Friday evening that the agency did not “yet have enough information to say definitively whether any sensitive or confidential personal information was accessed.”

She has not answered questions about whether or not services for unhoused people are disrupted.

LAHSA holds highly sensitive information collected from people experiencing homelessness in the region. The agency oversees the Homeless Management Information System, or HMIS, which includes unhoused people’s names, dates of birth, Social Security numbers and disabilities, as well as self-reported mental health and substance abuse history, income sources and domestic violence history.

In a statement Monday, LAHSA said it had taken its internal computer systems offline “as a precaution” and “engaged outside cybersecurity specialists to investigate the nature and scope of the incident.” The statement, sent on O'Neill's behalf by outside public relations strategist Trevor Daley, continued to call it “a potential cybersecurity incident.”

The agency is “taking steps to maintain essential operations,” the statement added, saying LAHSA “remains open” while the investigation continues. It said the agency is working with its technical and legal teams.

What staff were told

Friday’s email to "Team LAHSA" carried the subject line "URGENT: Log Off and Shut Down for the Week." LAist obtained a copy, and O'Neill confirmed by text message that she had sent it.

“As a precaution while we look into a potential security issue affecting our systems, we're asking all staff to stop work and take their machines offline for the remainder of today and through the weekend,” the email said.

It told employees to “Log off and shut down your LAHSA computer” and not to log back in or connect to LAHSA systems, including email, “until you receive an all-clear from us.”

The email also told staff to report anything “unusual” before shutting down, such as “files renaming on their own, unexpected pop-ups or messages.”

What LAHSA leadership has said

In a texted response to LAist on Friday evening, O'Neill said she asked staff to take their computers offline “out of an abundance of caution” while the agency’s IT team assessed the situation.

“Our IT team is actively reviewing the situation now and working to understand exactly what occurred and whether any information was affected,” she wrote. “Protecting people’s personal and confidential information is a top priority in that review.”

Leaders of three LAHSA-funded service providers told LAist on Monday afternoon that they had not received any communications from LAHSA about the potential cybersecurity issue. All three use the HMIS system that holds unhoused people’s personal details.

Previous attacks against another LA housing agency

Another L.A. housing agency was previously hit by cyberattacks. The Housing Authority of the City of Los Angeles — a separate agency known as HACLA — has said hackers got inside its network in 2022 and may have accessed people’s names, Social Security numbers, financial accounts numbers and medical information.

Two years later, HACLA was breached again, according to an official notice, with hackers potentially accessing names, dates of birth, Social Security numbers and phone numbers.

LAist reporter Aaron Schrank contributed reporting to this story.