HPD promises NYC housing lotteries are safe after data breach exposed info, but applicants' concerns linger
The chair of New York City Council's Housing Committee is pressing for answers about a data breach affecting thousands of applicants in the city's affordable housing lottery program.
The breach was first exposed in a CBS News New York investigation in July. Our story showed how some applications to the city-run Housing Connect lottery program popped up in search results for applicants' names, exposing addresses, incomes and Social Security numbers in some cases.
No known reports of identity theft or fraud, city says
City Council Housing Committee Chair Pierina Sanchez sent two city commissioners a letter seeking answers after our investigation revealed the data breach, asking how the applications ended up publicly viewable online and how many New Yorkers' private information were viewed.
"I'm really upset about this breach," she said. "If you are a New Yorker who is struggling to make ends meet, you're ... hoping that you're gonna score one of those apartments. You don't then also wanna worry about your identity being stolen."
The city's Housing Preservation and Development Department (HPD) responded to Sanchez's letter blaming a "system misconfiguration" of a portal overseen by Reside New York, one of the companies the city approved to review applications on behalf of private building developers in the program.
Reside New York CEO Martin Joseph says Reside removed the information and fixed the portal as soon as CBS News New York alerted them, and the company will do "everything and anything" to ensure this doesn't happen again.
"I wish it wouldn't have happened, but we did everything we could and we're trying to do even better," Joseph said.
He said a third party is to blame for the breach.
"We have utilized third party to assist us in vetting these tenants, and we were notified that there might be a potential exposure of personal data which was mistakenly done by a third party," Joseph said. "There was a mistake that that company performed and that was mitigated right away."
Joseph said that third party is a company called LogicFold, which would not agree to an interview for this story.
Reside is still working with LogicFold, but Joseph says he's made sure they've made changes to prevent a repeat.
Joseph said Reside has also hired a company to monitor the web and dark web for any traces of the data, and so far, they've found nothing.
He added data protection is of the utmost importance to him, and they're also doing a deeper analysis to prevent this from happening again.
According to Joseph and the city, there are no known reports of identity theft or fraud linked to the breach.
Data breach "unacceptable by our standards," HPD says
The city says the portal included 480,000 applications, but it says Reside analyzed traffic to the portal and found no one clicked on most of those.
The portal was up and accessible from May 2 to July 2, but no one in the public domain accessed it until mid-June, according to the analysis Reside provided the city.
HPD's response to Sanchez says some information for about 38,000 applicants was "possibly viewed," including their names, unverified incomes, phone numbers and emails.
Acting HPD Commissioner Ahmed Tigani says most Social Security numbers in the portal were redacted — all but 52 of them on the pages that were viewed — and, when it comes to applicants' birthdates, Tigani says no more than 592 were accessed.
He wants to reassure applicants Housing Connect is safe.
"I would first say that HPD sees this as something that should never have happened. This is an incident that is unacceptable by our standards, and it's something that we'll work to make sure that doesn't happen again," he said.
Tigani adds Reside New York is now under what the city describes as a corrective action plan.
"If anyone feels like they've been affected by this or they have questions about what this means for them, we invite them to call 311 or contact HPD and we will work them directly to get answers to the questions," he said.
Reside New York says it has alerted people who they already know had their data exposed and they're offering them credit monitoring.