A “significant amount of personal data” of people who applied to the Legal Aid Agency – including criminal records – was accessed and downloaded by hackers, the Ministry of Justice (MoJ) has said.
The group that carried out the cyber attack says it accessed 2.1 million pieces of data, but the MoJ has not verified that figure, it is understood.
The government became aware of the incident on 23 April, but realised on Friday it was more extensive than first thought.
An MoJ source put the breach down to the “neglect and mismanagement” of the previous government, saying vulnerabilities in the Legal Aid Agency systems have been known for many years.
The Legal Aid Agency (LAA), is an executive agency, sponsored by the MoJ, which is responsible for administering legal aid funding – around £2.3bn in 2023/24.
The data accessed affected those who applied for legal aid in the last 15 years, and may include contact details and addresses of legal aid applicants, their dates of birth, national insurance numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments.
The MoJ has urged anyone who applied for legal aid since 2010 to update any passwords that could have been exposed, and be alert to unknown messages and phone calls.
Cryptocurrency platform Coinbase warns of up to $400m hit from cyber attack
Thousands of UK companies ‘could have M&S-style hackers waiting in their systems’
Co-op updates on recovery after cyber attack forced empty shelves
The organisation’s digital services, which are used by legal aid providers to log their work and get paid, have been taken offline.
The Ministry of Justice (MoJ) said it is working with the National Crime Agency and National Cyber Security Centre to investigate the data breach.
It comes after retailers Co-op, Harrods and Marks & Spencer were hit by cyber attacks, although there is no suggestion that they are connected to the incident at the LAA.
