Cyber attack creates delays putting house purchases at risk

Homebuyers have been hit with delays following a cyber attack on an IT company used by hundreds of property conveyancers.

Tech company CTS was targeted by hackers on Nov 22 in an incident that has led its systems, used by as many as 200 companies, being down for almost a week and potentially throwing thousands of deals into doubt.

Sarah Grant, who began the process of downsizing from a five-bedroom property in Otford, Kent, in January, had been due to move into her new property on Nov 27. However, her completion date has been postponed. The 65-year-old image consultant had accepted a £900,000 offer and exchanged contracts with the buyer earlier this month. She was only made aware of the delay on

Nov 24 by her solicitor, Taylor Rose, who gave “no ETA” as to when the issue would be resolved.

Now living in an Airbnb without access to much of her clothes and possessions, she fears that a planned family gathering over Christmas in her new house will not be able to happen.

“It has been the biggest nightmare,” she said. “We are just left not knowing. It’s left this numb feeling, I’m angry.”

The sale is being held up because Cavendish, another law firm involved in the chain, has been affected by the attack. On Nov 24, the company told the buyers of Ms Grant’s property that it did not have access to emails due to the intrusion, and would likely not be able to process the sale. All of the moves in the chain are suspended indefinitely until the issue can be fixed. On Nov 27, Cavendish already had a backlog of 200 completions.

CTS provides cloud space and IT systems such as emails for firms. Industry sources said the attack was widely believed to be the result of a flaw in Citrix, a software program used by CTS. The so- called “Citrix Bleed bug” has been exploited by LockBit, a Russian-speaking hacking gang, according to CISA, the US cyber security agency.

A spokesman for CTS said that the outage of their IT systems was in the process of being fixed, but he would not give an updated number on the amount of firms that had been impacted nor a date for when it would be resolved.