The DC Housing Authority (DCHA), the agency that runs public housing and voucher programs for the District of Columbia, suffered a cybersecurity incident in June 2026 that compromised a limited set of sensitive data. As of the latest reporting, thousands of residents still do not know whether their own personal information was among the stolen files, because DCHA has not notified individuals about their specific records. That gap between "some data was taken" and "here is what was taken from you" is the core of the story. Below is what is confirmed, what remains a claim, who is exposed, and the concrete steps a resident can take right now.
Table of Contents
- What happened and when
- Who claimed the attack, and what is still unverified
- Why residents still don't know if their data was stolen
- What DCHA is offering and what the law requires
- Steps you can take now
- Frequently Asked Questions
What happened and when
DCHA detected the incident on June 28, 2026 and shut down its IT systems the same day as a precaution. That shutdown disrupted agency operations for weeks.
On July 17, 2026, DCHA confirmed that its forensic investigation found a "limited subset" of agency data was compromised, including some sensitive information. The agency also said it has found no evidence so far that any of the compromised data has been misused. DCHA resumed normal operations across all departments on July 20, 2026, roughly three weeks after the systems went dark.
Who claimed the attack, and what is still unverified
A ransomware group called Interlock — criminals who lock or steal an organization's data and demand payment — publicly claimed responsibility on July 16, 2026, according to Washington City Paper. The group asserted it stole about 1.6 terabytes of data. Treat that figure with caution.
DCHA has not independently confirmed the amount, and attackers routinely inflate claims to pressure victims into paying. The verified facts are narrower: DCHA acknowledges a limited subset of data was taken, not a specific terabyte count. That distinction matters for readers deciding how worried to be. "Confirmed compromised" and "claimed by the attacker" are two different levels of certainty, and only the first comes from the agency itself.
Why residents still don't know if their data was stolen
DCHA has confirmed a breach in general terms, but it had not told individual residents whether their specific records were among the stolen files, according to Washington City Paper. Forensic reviews of a large data set take time, and an agency often cannot name affected individuals until it finishes mapping exactly which files were touched.
The stakes are high because of what DCHA holds. The agency serves roughly 30,000 families and stores sensitive personal, financial, and health-related information on thousands of DC residents, plus financial records for participating landlords. If you are a DCHA resident, applicant, or landlord, assume your information could be involved until you receive a specific notice—but do not assume misuse has occurred, because none has been confirmed.
What DCHA is offering and what the law requires
DCHA said it will provide credit monitoring and identity-theft assistance to affected customers. Watch for an official notice describing how to enroll, and be wary of anyone contacting you out of the blue claiming to offer that service.
DC law also sets clear duties. Under DC Code §28-3852, a breached organization must notify affected residents without unreasonable delay, and must notify the DC Attorney General when a breach affects 50 or more residents. Given the scale here, that Attorney General notification requirement applies.
Steps you can take now
You do not need to wait for an individual notice to protect yourself. Consider these actions: Because DCHA holds health-related and financial data, also watch for medical bills or benefit notices tied to services you never received—an early sign of identity misuse.
- Watch for official DCHA updates through the agency's cybersecurity incident page rather than links sent by text or email.
- Place a free credit freeze with Equifax, Experian, and TransUnion to block new accounts in your name.
- Enroll in the credit monitoring DCHA offers once you receive verified enrollment instructions.
- Review bank, benefit, and credit statements for charges or accounts you do not recognize.
- Treat unexpected calls, emails, or texts referencing the breach as possible scams; do not share personal details or click links.
Frequently Asked Questions
Has anyone confirmed my data was misused?
No. DCHA says it has found no evidence yet that any compromised sensitive information has been misused, though that can change as the investigation continues.
Is the 1.6 TB figure reliable?
It is the Interlock group's claim, not a DCHA-confirmed number. Attackers often exaggerate, so treat it as unverified.
How will DCHA contact affected people?
DC law requires direct notification without unreasonable delay. Expect an official notice explaining any credit monitoring; verify it before sharing information.