U.K. Legal Aid Agency warns providers of security incident on its online systems

The Legal Aid Agency, the executive agency of the U.K. Ministry of Justice that administers legal aid in England and Wales, wrote to legal aid providers in early May 2025 to say it had identified a security incident on its online systems. The letter said financial information relating to providers may have been accessed by unauthorised third parties, but the agency could not confirm precisely what, if anything, had been taken.

The Ministry of Justice said it had detected unusual activity on the agency's digital services on 23 April 2025 and had brought in the National Crime Agency and the National Cyber Security Centre. It said it had already acted to strengthen the security of the affected system while the investigation continued.

The picture worsened after that first notice. On 16 May the agency established that the intruders had reached much further into its systems than first understood, and on 19 May the government confirmed publicly that data belonging to people who had applied for legal aid was involved. The Record reported that the compromised records covered applicants going back to 2010 and that the attackers claimed to hold information on more than two million individuals.

Reported categories included contact details and addresses, dates of birth, national identity numbers, criminal histories, employment status and financial data such as contribution amounts, debts and payments. The agency took its online service offline, the Ministry of Justice obtained a court injunction against publication of the stolen material, and the Law Society pressed for investment to modernise the agency's ageing IT systems.