NYC Housing Lottery Data Breach: HPD Promises Security After Applicant Information Exposed

NYC Housing Lottery Data Breach

• 🚨 A significant data breach has affected thousands of applicants in New York City's affordable housing lottery program, with personal information becoming publicly viewable online.
• 🔍 The breach was initially uncovered by a CBS News New York investigation in July, prompting city council housing committee chair Pina Sanchez to seek answers from city commissioners.

Scope of Exposed Information

• 📄 Questions remain about how many names, addresses, incomes, and social security numbers were viewed by the public.
• ⚠️ Some applications to the city-run Housing Connect lottery program appeared in search results, raising concerns about identity theft for struggling New Yorkers.
• 📊 The city's Housing Preservation and Development Department (HPD) stated that information for about 38,000 applicants may have been viewed, including names, unverified incomes, phone numbers, and emails.

Cause and Responsibility

• ⚙️ HPD blamed a "system misconfiguration" of a portal overseen by Reside New York, a third-party company approved to review applications for private building developers.
• 💻 Reside New York CEO Martin Joseph stated they removed the information and fixed the portal immediately upon notification, hiring a company to monitor the web for data traces.
• 🔒 A company called LogicFold was identified as the third party that made a mistake leading to the data exposure, though they declined an interview.

Security Measures and Reassurance

• 🛡️ Acting HPD Commissioner Amed Tagani assured that most social security numbers (all but 52 of those viewed) and a limited number of birth dates (under 592) were redacted or not accessed.
• ✅ Reside New York is now under a corrective action plan, and the city assures that Housing Connect remains safe.
• 📞 Applicants with concerns are encouraged to call 311 or contact HPD directly for assistance.
• 🤝 Reside New York is offering credit monitoring to individuals confirmed to have had their data exposed.

Portal Accessibility

• ⏳ The portal was publicly accessible from May 2nd to July 2nd, but analysis suggests public access to the data did not occur until mid-June.