Legal Aid Agency updates cyber incident

On 23 April 2025, the Legal Aid Agency (LAA) detected a cyber-attack that disrupted its online digital services and compromised personal data held by the Ministry of Justice. Immediate actions were taken to secure systems, and legal aid providers were informed that some of their financial information might have been exposed. Collaboration with agencies like the National Crime Agency and the National Cyber Security Centre followed.

By 16 May 2025, investigations revealed that the breach was more extensive than initially thought, with a substantial amount of personal data, including information on legal aid applicants and providers, being accessed and exfiltrated. The LAA reported this sensitive information to the public while continuing their digital analysis to comprehend the full extent of the compromised data. They confirmed that most data related to applications, claims, or payments between January 2007 and May 2025; however, around 250,000 records were confirmed to predate 2007, with the earliest from 1978.

A notable aspect of the breach was the inclusion of information from the HM Prison and Probation Service (HMPPS), specifically probation data without victims' details. The investigative team ensured a thorough understanding of the type of information affected, indicating that variations exist between individual cases. The LAA reassured the public that, while records prior to 2007 exist, this does not imply that all individuals from that time frame were impacted.

Affected individuals include legal aid applicants, recipients, and practitioners, each with varying degrees of data exposure. For example, among applicants, data such as full names, National Insurance numbers, and case details may have been compromised. Practitioners also received updates, and their data could include banking details and access information. The agency stressed that the presence of records does not necessarily equate to individual compromise, and they urged anyone who might be affected to remain vigilant against suspicious communications.

The LAA, while revealing extensive details about the incident, acknowledged the complexity of the data involved, which included unstructured and fragmented information that complicated their analysis. As their capabilities improved, they adapted their public communications to reflect the latest understanding of the breach.

Moving forward, the Ministry of Justice and the LAA implemented enhanced security measures to safeguard against similar incidents, such as upgrading authentication protocols and improving security monitoring. The LAA maintains that, as of now, there is no evidence to suggest that stolen data has been shared or published.

For those seeking further information or feeling concerned about the breach, the LAA has established contact channels for support and queries related to the incident, ensuring that individuals can get specific assistance regarding their circumstances. The agency continues to monitor the situation and provide updates to the public as developments arise.