HUD Issues Guidance Requiring Report of Cyber Incidents
By: Andrew Van Horn, Policy and Research Advisor
August 10, 2026 — On July 14th, HUD issued PIH Notice 2026-17, “Cyber Incident Reporting Requirements.” When PHAs experience a cyber incident, they must notify HUD within 36 hours of becoming aware of the incident and should also contact law enforcement. The notice provides specific guidance on the following topics:
- The legal definition for what constitutes a “cyber incident,”
- Requirements to reach out to HUD’s Cyber Incident Response Team at [email protected] and the agency’s field office,
- A recommendation to notify both law enforcement and the FBI’s Cyber Crimes unit, and
- Specific details of the incident agencies should include in their email to HUD.
HUD’s team will reach out to the agency following report of a cyber incident.