Cyberattack deals major blow to Minneapolis affordable housing push

A nonprofit Minneapolis developer has halted nearly all work while it scrambles to raise cash after cyber attackers stole its operational cash, savings and reserve accounts.

Housing in Action, a 30-year community developer in north Minneapolis, announced last week it was hit in a targeted cyberattack in May, losing nearly $800,000 — all its operational cash, savings and reserve accounts — to unknown hackers. The organization has suspended all the work it had planned this summer to repair its rental properties and build four new houses.

“We’re in a hustle, doing everything that we can to minimize the impact of this on the community,“ said Housing in Action Executive Director AsaleSol Young.

The organization is working with the FBI and the Minneapolis Police Department to identify the culprit, and has hired a private investigator to understand how hackers gained access to the sensitive information. It’s also selling empty lots that were being held for future construction, and asking donors for help through what could be an existential setback for the organization.

“We’re pursuing all these avenues to avoid what we consider the worst case scenario, which is having to sell additional rental properties in order to restore the funds,” Young said. Selling would decrease the area’s affordable housing stock and displace tenants. “The loss of Housing in Action would have an incredibly deep impact on what is already a severe issue for community.”

The Minneapolis police investigation is open and active, records show. An FBI Minneapolis spokesperson said the FBI typically does not confirm or deny whether it’s conducting an investigation.

Young said they were told it will be nearly impossible to recover the stolen funds.

Housing in Action, known for most of its history as Urban Homeworks, specializes in rehabilitating neglected houses and infill developments on long-vacant lots in north Minneapolis. It also has a down payment grant program for first-time homebuyers as part of its mission to help low-income families build equity, but those grants are also stalled after the cyberattack.

While other nonprofit housing developers (such as Habitat for Humanity and Project for Pride in Living) do similar things, Housing in Action is deeply rooted in north Minneapolis with the purpose of alleviating the area’s specific challenges, said Gretchen Nicholls, program officer of Local Initiatives Support Corporation Twin Cities.

The theft was a tragic blow, Nicholls said, because nonprofit community developers already work under a host of difficult conditions without a lot of assets.

Karen Graham, a Minneapolis cybersecurity consultant who works exclusively with nonprofits, said that while it can be difficult for regular people to comprehend why anyone could rob an organization that helps people, there’s a perception — grounded in some reality — that they make easy targets.

“They don’t always have the same kind of resources for security that larger organizations might have, and it can be really difficult to prioritize something like that when you’re a very mission-driven organization and your reason for being is to help people,” Graham said. “It becomes almost kind of painful to spend $1 on something that feels like it’s just back-office infrastructure. It’s not directly helping people.”

Two years ago, hackers stole $1 million that the Margaret A. Cargill Foundation tried to transfer to an Alaska organization helping seniors maintain their independence in rural America. In that case, the Eden Prairie Police Department helped recover more than $700,000, and the foundation fulfilled the grant, said Margaret A. Cargill Philanthropies spokesperson Leeanne Huber.

Eden Prairie police referred the case to the Hennepin County Attorney’s Office in May, said Chief Matt Sackett. If charges are filed, additional information will become available about the investigation, suspect and method of recovering funds.

Housing in Action said in a statement that the organization had long-standing cybersecurity infrastructure, and recognizing its importance.

Housing in Action does not yet know how the attack took place, according to the organization, but an outside IT firm hired to investigate its server and emails confirmed there was no third-party access of internal data. It has opened new banking accounts, and raised nearly $400,000 in the month and a half since the theft took place.

It’s now appealing to individual donors to help make up the rest.

In 2023, Housing in Action received a $5 million legislative appropriation to develop affordable homes for ownership. Those funds were partially affected by the theft, which also wiped out the organization’s normal operating cash used to start projects and leverage into other grants and loans, said Lee Schafer, a former Star Tribune columnist and Housing in Action donor.

“That’s the thing that’s really painful here,” he said. “There might be various forms of city money, private donations, foundation money in a given project. It takes a while to assemble all that, but you have to have some money to pay the bills to get all that going.”

Claudia Oxley, a member of the leadership team at First Covenant Church and a former board chair of Housing in Action, urged the public not to default to blaming the organization as it rebuilds.

“There’s always questions, as there should be, about ... ‘What did we do wrong? What were our financial controls?’” she said. “I have seen Housing in Action, their board and their auditors, really look hard at those kinds of questions. ... They’re doing the kinds of things management should do, and organizations, just like people, can be victims of crime.”