Legal Aid Agency

Summary

The Legal Aid Agency reported a cyber security incident that may have exposed financial information of legal aid providers. The agency said it could not confirm what data was accessed but noted that payment details might have been viewed by an unauthorized party. It works with the Ministry of Justice, the National Crime Agency and the National Cyber Security Centre to investigate the breach and has taken steps to mitigate the impact. Nearly two thousand providers, including solicitors’ firms, barristers, not‑profit groups and telephone operators, could be affected. The agency employs about twelve hundred staff and manages billions of pounds in legal aid funding each year.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Tuesday 6 May 2025, the Legal Aid Agency (LAA) announced that it had been hit by a cyber security incident. The agency, which oversees billions of pounds of legal aid funding in England and Wales, said in a letter sent to law firms the previous week that it had identified a security incident. The letter, seen by Sky News, stated that it is possible that financial information relating to legal aid providers may have been accessed by a third party. The LAA noted that it could not confirm what, if any, information was accessed, but added that it was possible that payment information may have been accessed. The agency emphasized that the incident is being investigated in accordance with its data security processes and that action has been taken to mitigate the situation.

The Legal Aid Agency provides legal aid in civil and criminal cases and administers funding that amounted to approximately £2.3 billion in the 2023/24 financial year. Nearly 2,000 providers, including solicitors’ firms, barristers, not‑for‑profit organisations and telephone operators, are contracted to deliver legal aid services across England and Wales. The agency’s head office is located in London, with additional offices in towns and cities throughout the region, and it employs around 1,250 staff. Law firms are noted as attractive targets for cyber attacks because they hold sensitive client information and handle large sums of money.

In response to the incident, the Ministry of Justice said it takes any data breach extremely seriously and has already taken action to bolster the security of the legal aid system. The Ministry confirmed that it is working with the National Crime Agency and the National Cyber Security Centre to investigate the breach, and that it would be inappropriate to comment further at that stage. A spokesperson for the National Crime Agency said that officers are aware of the cyber incident affecting the Legal Aid Agency and are working alongside partners in the National Cyber Security Centre and the Ministry of Justice to better understand the situation and support the department.

The announcement of the incident follows a series of cyber attacks on retailers such as Co‑op, Harrods and Marks & Spencer, although the sources explicitly state that there is no suggestion of any connection between those events and the incident involving the Legal Aid Agency. The agency’s letter concluded with an apology for any concern caused and reiterated that it takes the security of the information it holds seriously.

Sources

Sources available to members: 1 source.