Cyber attack on Legal Aid Agency exposes 18 years of user data, says Ministry of Justice

The Ministry of Justice said that a cyberattack on the Legal Aid Agency compromised sensitive personal data of users who accessed the service over the past 18 years.

 

On May 19, in a press release, the Ministry of Justice said that on April 23, it became aware of a significant data security incident affecting Legal Aid Agency’s online digital services. The agency immediately launched an investigation, with assistance from cyber security experts, to determine the nature and scope of the incident.

 

LAA also notified the National Crime Agency, National Cyber Security Centre and the  Information Commissioner Office about the incident.

 

On May 16, MoJ said that the data security incident was more extensive than initially anticipated. Hackers have accessed and stole a large amount of personal data related to legal aid applicants using the digital service since 2010.

 

In a recent update, the LAA said that cyber criminals who breached its internal network stole personal data from applicants who used the digital service over the past 18 years.

 

“We believe the group accessed and downloaded a significant amount of personal data from those who applied for legal aid through our digital service between 2007 and 16 May 2025 when the systems were taken offline,” reads the update.

 

The compromised data included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments.

 

LAA has urged applicants for legal aid during this period to remain vigilant amid potential data risks, monitor for suspicious activity, update passwords, and verify identities before sharing personal information. It has also taken steps to strengthen its system security and notified legal aid providers that some of their details may have been compromised.

 

An injunction has been issued by the LAA prohibiting the sharing of this data. Breaching this order could result in imprisonment.