decrypted · 14 october 2026 · supply chain · surveillance and privacy · digital sovereignty

The Housing Ombudsman's complaints system is down, and the fault sits with a supplier

The Housing Ombudsman Service, the body that settles disputes between social housing residents and their landlords, cannot currently accept a complaint online. The cause is what it calls a "third-party IT security incident" that hit its case management system on Tuesday. That is a quieter story than this morning's zero-day, but for a UK director it may be the more instructive one, because the failure sat in a supplier, not in the organisation's own estate.

What is known, and what is not

The Ombudsman's own statement, last updated at 13:00 today, says the incident has been contained and that it is working with an external supplier to establish the full facts, including the extent of the data involved. Until systems return, nobody can submit a new complaint, view an existing one, or use web chat or the webform. Inside Housing reported that the landlord portal is also offline. The fallback is email and the telephone. The incident has been reported to the data protection regulator.

The supplier has not been named, and nor has any attacker. Nobody has claimed responsibility that I can verify, so this is not a ransomware story until someone says it is. Inside Housing reported that contact details such as names, addresses and telephone numbers may have been copied, which it drew from a message sent to those affected. The Ombudsman's public statement says only that it is still checking whether personal information was involved. Treat the data question as open.

The mechanism, in plain English

Think of a public office that hires a specialist firm to run its filing room. Residents hand their paperwork to the office, but the cabinets, the keys and the night cleaner all belong to the contractor. If the contractor's back door is propped open, the office has lost control of its records without anyone having walked through its own front door.

The Ombudsman holds the duty to protect residents' complaints, which often include health, family and money details. The supplier holds the system. Contracts can move liability around, but they cannot move the harm to a resident whose address is in the wrong hands.

What the defender sees

Mostly, an absence. A hosted case system that stops answering looks like an outage first and an incident second. The organisation's own logs show little, because the interesting activity happened in someone else's environment. The first reliable signal is often a call from the supplier, and the quality of that call depends entirely on what was agreed beforehand.

The Secure by Design lesson

Secure by Design asks the builder, not the customer, to carry the burden of safety. Applied to suppliers, that gives a short list a board can ask for this week:

Contractual notification windows measured in hours, with a named contact who answers at weekends.
A current map of which supplier holds which categories of personal data.
Logging the customer can see, not only the supplier.
A tested manual route for the service. The email and telephone fallback here works because someone planned for it.

None of this is expensive compared with a service closed to the public. The uncomfortable part is the conversation with the supplier at renewal, not the money.

Also this week

Docker Hub tokens followed the wrong owner. Docker published an advisory for CVE-2026-105445, rated critical. Since 26 August 2024, converting a personal Docker Hub account into an organisation reassigned its personal access tokens to the named owner without rotating them, so the original creator kept working access, acting as that owner at the registry level. Docker says it received the report on 30 September 2026 and deployed a fix less than four hours later, emailed the limited number of exposed users on 2 October, and deactivated the transferred tokens on 8 October. It found no evidence of exploitation after reviewing about 304,000 pushes made with transferred tokens, though it notes logs cannot show tokens that were never used. The design lesson is unglamorous: a credential should never change hands as a side effect of an administrative action. Teams pulling images in production should pin by digest.

A US court order, a Japanese investigation and British inboxes. Microsoft announced today that, working with Japan's National Police Agency, Health-ISAC and others, it obtained an order from a US federal court in the Southern District of Florida to seize and redirect domains tied to YAM Store, CoGUI and Iron Man, a Chinese-language phishing marketplace and its kits. Figures differ by report: The Record cites more than 750 million messages aimed at Microsoft customers since January, while BleepingComputer cites more than 1 billion in total. Neither report ties the platforms to the UK specifically. The structural point is that a US company, using a US court, is now a front-line disruptor of crime landing in British mailboxes. That is useful, and a reminder of who holds the switch. Phishing-resistant sign-in remains cheaper than waiting for the next takedown.

Sources

If your suppliers hold your customers' data and you would like a second opinion on the contract, get in touch.