The UK’s Legal Aid Agency has confirmed that a ‘significant amount of personal data’ relating to legal aid applicants has been stolen in a cyber-attack, with applicants dates of birth, national ID numbers, criminal history, employment status and some financial data all at risk.

In a statement, the Ministry of Justice said that while the Agency first became aware of the cyber-attack last month, on Friday (16th May) it discovered that the incident was more extensive than originally thought, and that the group behind it had accessed a large amount of information concerning those who applied for legal aid through its digital service since 2010.

Following the attack, the Agency was forced to shut down its online services, and has urged members of the public who have applied for legal aid to take steps to protect themselves.

“I understand this news will be shocking and upsetting for people and I am extremely sorry this has happened,” said Jane Harbottle, CEO of the Legal Aid Agency.

“Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems so we can safely continue the vital work of the agency.

“However, it has become clear that to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the online service down.

“We have put in place the necessary contingency plans to ensure those most in need of legal support and advice can continue to access the help they need during this time.”

Recommended reading

• Scattered Spider Linked to M&S Cyber-attack Chaos
• M&S Apologises To Customers Following ‘Cyber Incident’
• How Have Cyber Experts Reacted to the M&S ‘Incident’?

While the MoJ has not disclosed the exact scale of the incident, a report from the PA news agency said that the as yet unnamed group behind the attack claims to have accessed 2.1 million pieces of data.

According to various reports, including from Sky News, an MoJ source said the breach was a result of ‘neglect and mismanagement’ by the previous government, with vulnerabilities in the Legal Aid Agency systems having been known for years.

In its review of legal aid in 2023, the Law Society of England and Wales called on the UK Government to urgently invest in updating the Legal Aid Agency’s IT systems, warning that it was ‘too fragile to cope’.

Speaking to the Law Society Gazette, Law Society president Richard Atkinson said this latest cyber incident was evidence of the need to bring the Agency’s ‘antiquated’ digital systems up to date.

The MoJ said that the Legal Aid Agency will provide further details about the cyber-attack in due course, but continues to work with specialists and investigators in the meantime.  

Don’t Miss Scotland’s Biggest Tech Event!

Join us at DIGIT Expo West on 5th June at the SEC Glasgow. Get leading industry insights across AI, Cyber Security, and Data, and grow your network at Scotland’s largest gathering of tech leaders – with 1500+ attendees, 50+ speakers, and 50+ exhibitors.

Register your FREE place now at www.digitexpowest.com