A “significant amount of personal data” of people who applied to the Legal Aid Agency – including criminal records – was accessed and downloaded by hackers, the Ministry of Justice (MoJ) has said.
The group that carried out the cyber attack says it accessed 2.1 million pieces of data, but the MoJ has not verified that figure, it is understood.
The government became aware of the incident on 23 April, but realised on Friday it was more extensive than first thought.
An MoJ source put the breach down to the “neglect and mismanagement” of the previous government, saying vulnerabilities in the Legal Aid Agency systems have been known for many years.
The Legal Aid Agency (LAA), is an executive agency, sponsored by the MoJ, which is responsible for administering legal aid funding – around £2.3bn in 2023/24.
The data accessed affected those who applied for legal aid in the last 15 years, and may include contact details and addresses of legal aid applicants, their dates of birth, national insurance numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments.
The MoJ has urged anyone who applied for legal aid since 2010 to update any passwords that could have been exposed, and be alert to unknown messages and phone calls.
The organisation’s digital services, which are used by legal aid providers to log their work and get paid, have been taken offline.
‘We needed to take radical action’
Legal Aid Agency chief executive Jane Harbottle has apologised for the breach and acknowledged the news would be “shocking and upsetting”.
“Since the discovery of the attack, my team has been working around the clock with the National Cyber Security Centre to bolster the security of our systems so we can safely continue the vital work of the agency,” she said.
“However, it has become clear that, to safeguard the service and its users, we needed to take radical action. That is why we’ve taken the decision to take the…
