A data breach in New York City’s Housing Connect lottery program exposed sensitive personal information of 38,000 applicants, including names, unverified incomes, phone numbers, emails, and—though mostly redacted—52 unredacted Social Security numbers and 592 birthdates. The breach occurred due to a system misconfiguration in a portal managed by Reside New York, a city-approved vendor, and was traced to a third-party contractor (LogicFold), which mistakenly made applicant data searchable online between May 2 and July 2, 2024. While no confirmed cases of identity theft or fraud were reported, the exposed data included financial and personally identifiable information (PII), raising risks of potential misuse. Reside New York removed the exposed data after being alerted by CBS News, implemented web/dark web monitoring (finding no leaked traces), and offered credit monitoring to affected individuals. The city’s Housing Preservation and Development Department (HPD) deemed the incident unacceptable and placed Reside under a corrective action plan to prevent recurrence.