Most small businesses run on online services owned by someone else. This week is a reminder that when a shared platform has a problem, every customer on it can have the same bad day at once. Here’s the story, and a practical plan, with no daft jargon.
What happened?
On Tuesday 13 October, the Housing Ombudsman Service (HOS), which handles complaints from social housing residents in England, published a statement: “We are aware of a third-party IT security incident that has impacted our case management system. The incident has been contained, and we are working with our external supplier to establish the full facts, including the extent of the data involved.” It said it had reported the incident to the Information Commissioner’s Office (ICO) (HOS).
In an email to affected people the same morning, HOS said that “some contact details such as name, address, telephone number and postal addresses may have been copied from our system”. It had taken “precautionary steps to prevent further unauthorised activity”, which meant it could not get into its case management system, so its online form, landlord portal and web chat were offline (HOS email). Residents were asked to email or phone instead (HOS).
HOS told Inside Housing it couldn’t yet say how many people are affected. For scale, it made findings in more than 20,000 cases in 2025-26 (Inside Housing). It has also warned people to be careful with unexpected emails, texts and calls asking for personal information (BleepingComputer).
It wasn’t just one organisation
Several other complaints bodies posted notices on 13 October:
Scottish Legal Complaints Commission (SLCC): unable to access its complaints system “due to a security incident, which is being investigated by one of our software suppliers”. It shut access down as a precaution and doesn’t yet know whether data is affected (SLCC).
Scottish Public Services Ombudsman (SPSO): “technical issues with our complaints management system”, with its complaint form offline and the SPSO “working with the supplier to restore this” (SPSO).
Local Government and Social Care Ombudsman (LGSCO): its online complaint service was unavailable, so people couldn’t register or view complaints (LGSCO).
Northern Ireland Public Services Ombudsman (NIPSO): a notice dated 13 October says “the system we use to manage our casework is currently unavailable” due to “an ongoing issue” (NIPSO).
Only HOS and the SLCC have said theirs is a security incident. The SPSO, LGSCO and NIPSO notices don’t give a cause.
Who is the supplier? What’s confirmed and what’s inferred
Confirmed: none of these organisations has named its supplier, and as of the morning of 14 October we found no public statement from any software company about the incident.
What the evidence points to: it is widely believed in the sector that the supplier is Workpro, a case management system made by Computer Application Services Ltd (CAS), an Edinburgh company (company number SC102278) (Companies House). The public record shows:
HOS: Workpro’s own case study says HOS uses Workpro for all its casework and moved to Workpro’s cloud hosting (Workpro).
LGSCO and SLCC: both feature in Workpro case studies (Workpro) (Workpro on LinkedIn).
SPSO: its own records document names its casework system as WorkPro (SPSO).
Hosting: Workpro’s G-Cloud listing says hosted systems run from two UK data centre locations “managed by our cloud hosting partner”, which it doesn’t name (Digital Marketplace).
Put together, several Workpro customers losing their case systems on the same day, two of them citing a security incident at a supplier, makes Workpro the most likely common link. That is an inference, not a confirmed fact. The problem could also sit further down the chain, such as with a hosting provider. Since 13 October, most pages on workpro.com have returned “page not found” errors. We don’t know why, and it may be unrelated.
The latest, and what we still don’t know
At about 08:00 on Wednesday 14 October, HOS’s online services were still down and its statement hadn’t changed (HOS). The SLCC had promised an update on the morning of 14 October, but hadn’t yet posted one (SLCC). The SPSO notice was still up (SPSO). The LGSCO homepage notice had been taken down and its complaints portal login page was loading again, but the LGSCO hasn’t said publicly whether service is fully back.
We don’t know how the incident started, when it began, how many people are affected, or whether other customers of the same supplier are involved. We found no ransomware group claim on the trackers we checked, and no public statement from the ICO.
Why this matters to you: your suppliers are part of your security
HOS and the SLCC both point to a problem at a supplier, not in their own offices. That’s supply chain risk, and it applies to a five-person firm as much as to a national ombudsman. The NCSC warns that attackers have shown they can and will exploit weak points in supply chains, and that many organisations lose sight of theirs (NCSC).
1. Know which suppliers hold your data, and who hosts them
List every online service your business uses, what data each one holds (customers, staff, payments), who owns the relationship, and where it’s hosted. Ask whether the supplier relies on other companies, such as a hosting partner. Workpro’s listing shows how common that is (Digital Marketplace).
2. Ask your key suppliers the right security questions
You don’t need a 200-question audit. The NCSC’s short list of supplier assurance questions covers the essentials: who is responsible for security at the supplier, whether they’ve had breaches they need to declare, what recovery plan keeps a minimum service running for you if they’re hit by something like ransomware, and how they protect their cloud services (NCSC). Certifications such as Cyber Essentials or ISO 27001 are a good sign, but not a guarantee.
3. Put it in the contract: data processing and breach notification
If a supplier handles personal data for you, UK GDPR requires a written contract with set terms, often called a data processing agreement (DPA). The ICO says it must cover, among other things, that the supplier only uses the data on your instructions, keeps it secure, helps you notify personal data breaches to the ICO and to the people affected, only uses sub-processors with your authorisation, and deletes or returns your data when the contract ends (ICO). The NCSC adds that contracts should spell out how incidents are reported, including timescales and who to report to (NCSC). If yours says “in due course”, ask for a named contact and a firm deadline.
4. Export and back up your SaaS data
“It’s in the cloud” isn’t the same as “it’s backed up for me”. Check that each key service lets you export your data in a usable format (CSV, Excel, PDF), do it on a schedule, and keep a copy the supplier doesn’t control. The NCSC recommends at least one backup that is offline or disconnected when not in use, and testing that you can restore it (NCSC).
5. Plan a manual fallback for when a portal goes dark
HOS, the SLCC, the SPSO and NIPSO all fell back on the same thing: phone and email (HOS) (SLCC) (SPSO) (NIPSO). If your booking system, CRM or ordering portal vanished tomorrow, how would you take an order? A shared mailbox, a phone line, a paper log and a website note go a long way. Keep supplier support numbers printed, not only in the system that’s down.
6. Turn on multi-factor authentication everywhere
We don’t know how this incident started, so we’re not claiming MFA would have prevented it. But stolen passwords are one of the commonest ways into online accounts, and the NCSC says 2-Step Verification (also called MFA or 2FA) protects your accounts even if a password is stolen (NCSC). Switch it on everywhere, starting with admin accounts, and ask suppliers if their staff use it. And treat unexpected “your data may be affected” messages with care: scammers love a news story.
7. Have an incident plan, including the ICO 72-hour rule
Write down who takes the call if a supplier reports an incident, who checks the data involved, who talks to customers, and who decides whether to report it. If personal data you’re responsible for is involved, a reportable breach must be reported to the ICO without undue delay and within 72 hours of becoming aware of it (ICO). If you’re responsible for the data, that duty stays with you even if the breach happened at your supplier, so your contract should require them to help you notify (ICO). Keep a printed copy of the plan (NCSC).
Your supplier-risk checklist
- List every online service you use, what data it holds and who hosts it.
- Ask your key suppliers the five questions above and note their answers.
- Check your contracts for a data processing agreement and a clear breach-notification clause.
- Export your data regularly, keep one copy offline, and write a manual fallback for each key service.
- Turn on MFA for every service, starting with admin accounts.
- Write a short incident plan, including who reports to the ICO within 72 hours.
References
- Housing Ombudsman Service, “Housing Ombudsman Service statement: IT Security Incident”, 13 October 2026
- Housing Ombudsman Service, “Important information about an IT security incident”, email, 13 October 2026, 11:20 BST
- Inside Housing, “Sector watchdog’s case management system hit by cyberattack”, 13 October 2026
- BleepingComputer, “UK Housing Ombudsman Service investigates ‘security incident’”, 13 Oct 2026
- Scottish Legal Complaints Commission, “SLCC complaints system currently unavailable”, 13 October 2026
- Scottish Public Services Ombudsman, “Complaint form offline” notice, viewed 14 October 2026
- Local Government and Social Care Ombudsman, online complaint service notice, viewed 13 October 2026
- Northern Ireland Public Services Ombudsman, homepage notice dated 13 October 2026
- Companies House, Computer Application Services Limited, SC102278
- Workpro, Housing Ombudsman Service case study, 2024 (PDF)
- Workpro, Local Government and Social Care Ombudsman case study, 2024 (PDF)
- Workpro on LinkedIn, “SLCC Transforms Complaint Management with Workpro Software”
- Scottish Public Services Ombudsman, “Information Governance” (names WorkPro)
- Digital Marketplace (G-Cloud), “Workpro Complaints Management software” service listing
- National Cyber Security Centre, “Supply chain security guidance”
- National Cyber Security Centre, “Supplier assurance questions”
- Information Commissioner’s Office, “What needs to be included in the contract?”
- National Cyber Security Centre, “Offline backups in an online world”, blog post
- National Cyber Security Centre, “Setting up 2-Step Verification (2SV)”
- Information Commissioner’s Office, “72 hours – how to respond to a personal data breach”
- National Cyber Security Centre, “Small Business Guide: Response & Recovery – Step 1”
Need a hand applying any of this to your business? Get in touch — call +44 1472 564538 or email services@msl.org.uk.