Legal Aid Agency

Profile narrative

The Legal Aid Agency (LAA) is a UK executive agency responsible for administering legal aid funding across England and Wales. It manages billions of pounds in legal aid funding each year, providing financial support for legal representation and advice to eligible individuals. The agency contracts with nearly two thousand legal aid providers, including solicitors' firms, barristers' chambers, not-for-profit organisations, and telephone operators, who deliver services to the public. Its payment systems handle transactions for this diverse provider base, ranging from large commercial firms to small not-for-profit groups. As an executive agency of the Ministry of Justice, the LAA operates within the public sector to ensure access to justice through state-funded legal assistance. The agency employs approximately twelve hundred staff and oversees a significant financial footprint through its administration of legal aid budgets.

Its distinguishing role lies in its regulatory function as the central body that assesses eligibility, processes payments, and monitors compliance among contracted providers. The LAA has faced notable cyber security challenges in recent years. A cyberattack in late 2024 compromised the agency's online portal, leading to unauthorised access to legal aid providers' information and sensitive personal data from citizens over a multi-year period, causing significant service disruptions. A separate incident reported in 2025 may have exposed financial information of providers, with the agency acknowledging that payment details might have been viewed by an unauthorised party though it could not confirm the specific data accessed. In response, the agency has worked with the Ministry of Justice, the National Crime Agency, and the National Cyber Security Centre to investigate the breaches and mitigate impact. Recovery efforts have included a phased restoration and migration to a new identity management system for all providers, while accelerated plans aim to modernise technology infrastructure and replace legacy systems with more resilient solutions.

Incidents

3 incidents linked to this organisation.